Is Jenkins vulnerable to CVE-2015-0235?

Article ID:204155740
1 minute readKnowledge base

Issue

  • Is Jenkins vulnerable to CVE-2015-0235?

Environment

Jenkins (Enterprise)

Resolution

Jenkins is not vulnerable to CVE-2015-0235. Jenkins uses the JVM and not the *glibc *library directly.

CVE-2015-0235 was logged as a security issue in 2010, and fixed in 2013. The security vulnerability was not announced publicly until 2015, so some older linux installations would need to upgrade. See https://www.openwall.com/lists/oss-security/2015/01/27/9 for more information.

This article is part of our Knowledge Base and is provided for guidance-based purposes only. The solutions or workarounds described here are not officially supported by CloudBees and may not be applicable in all environments. Use at your own discretion, and test changes in a safe environment before applying them to production systems.