Arbitrary File Read Affecting org.jenkins-ci.main:remoting package, versions [,3206.3208.v409508a_675ff) [3248.v65ecb_254c298,3248.3250.v3277a_8e88c9b_) [3256.v4da_9d93e1a_f3,3256.3258.v858f3c9a_f69d)
Threat Intelligence
EPSS
0.05% (21st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIMAIN-8073092
- published 24 Sep 2024
- disclosed 7 Aug 2024
- credit yangyue (Nebulalab), jiangchenwei (Nebulalab)
Introduced: 7 Aug 2024
CVE-2024-43044 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.main:remoting to version 3206.3208.v409508a_675ff, 3248.3250.v3277a_8e88c9b_, 3256.3258.v858f3c9a_f69d or higher.
Overview
Affected versions of this package are vulnerable to Arbitrary File Read via the ClassLoaderProxy#fetchJar method due to improper restrictions.
Calls to Channel#preloadJar by the attacker can result in the agent retrieving files from the controller using ClassLoaderProxy#fetchJar.
In some cases, exploiting this vulnerability might result in remote code execution.