The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.
{
"versions": [
{
"introduced": "0"
},
{
"last_affected": "1.642.1"
},
{
"introduced": "0"
},
{
"last_affected": "1.649"
},
{
"introduced": "0"
},
{
"last_affected": "3.1"
}
]
}