CVE-2022-0538

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins	>= unspecified, <= 2.333; >= unspecified, <= LTS 2.319.2

References

http://www.openwall.com/lists/oss-security/2022/02/09/1Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2022-02-09/#SECURITY-2602Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/02/09/1Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2022-02-09/#SECURITY-2602Vendor Advisory

Timeline

Published: Feb 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-05395.4Cross-site Scripting (XSS) - Stored in Packagist ptrofimov/beanstalk_console prior to 1.7.14.CVE-2022-05409.8A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP reques CVE-2022-05419.8The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate CVE-2022-05426.1Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0.CVE-2022-054310.0It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape CVE-2022-05445.5An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data using CVE-2022-05457.8An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability,CVE-2022-05467.8A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause CVE-2022-05479.8OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes u CVE-2022-05496.5An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio CVE-2022-05507.2Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker w CVE-2022-05517.2Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with adm