CVE-2018-1999042: Deserialization of Untrusted Data in Jenkins
Summary
CVE-2018-1999042: Deserialization of Untrusted Data in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.121.3
>= 2.122, < 2.138
Fixed in 2.121.3 or 2.138, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that helps automate various tasks in software development. It is widely used for continuous integration and delivery processes. The vulnerable package in focus is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its main functionality.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1999042, exists in Jenkins versions 2.137 and earlier, as well as 2.121.2 and earlier. It stems from a flaw in the XStream2.java file, which allows attackers to exploit the deserialization process of java.net.URL instances. By manipulating the deserialized data, an attacker can trick Jenkins into resolving a domain name of their choice. This can lead to various security issues, such as unauthorized network access or remote code execution.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.121.32.121.3 -
>= 2.122, < 2.1382.138
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Jenkins is not immediately feasible, a temporary workaround is to disable the deserialization of untrusted data in Jenkins. This can be achieved by configuring Jenkins to use a custom XStream instance with restricted permissions. Here is an example of how to implement this workaround:
import hudson.util.XStream2;
public class CustomXStream extends XStream2 {
public CustomXStream() {
super();
// Configure XStream with restricted permissions
// Add necessary restrictions to prevent deserialization of untrusted data
}
}
To use the custom XStream instance, update the Jenkins startup script or configuration to instantiate and use the CustomXStream class instead of the default XStream2 class.
Conclusion
In conclusion, CVE-2018-1999042 is a vulnerability in Jenkins that allows attackers to manipulate the deserialization process and potentially gain unauthorized network access or execute remote code. It is crucial to upgrade Jenkins to the fixed versions mentioned or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability allows attackers to manipulate the deserialization process in Jenkins, potentially leading to unauthorized network access or remote code execution. It is crucial to address this vulnerability promptly to prevent any security breaches.
Jenkins versions 2.137 and earlier, as well as 2.121.2 and earlier, are affected by this vulnerability. It is recommended to upgrade to the fixed versions mentioned in the 'how_to_fix' section.
While specific exploits targeting this vulnerability have not been disclosed, it is important to assume that attackers may attempt to exploit it. Promptly applying the recommended fixes is the best defense against potential exploits.
Yes, the CVSS score for this vulnerability is 5.3, indicating a moderate severity level. It is essential to address this vulnerability to mitigate potential risks.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
