CVE-2017-2598 json
Inadequate Encryption Strength in Jenkins
published 2018-05-23 8 y ago modified 2026-06-17 4 mo ago also GHSA-r9q2-3r6x-qmgp , EUVD-2022-5141
- cvss
- 4.3
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).
Patch / fix
- maven org.jenkins-ci.main:jenkins-core 2.32.2, 2.44
- jenkins jenkins 2.32.2, 2.44
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2017-2598 updated cvss 4.3
jenkins: Use of AES ECB block cipher mode without IV for encrypting secrets (SECURITY-304)
-
Red Hat OpenShift Enterprise 2 jenkins Red Hat OpenShift Enterprise 3 jenkinsunder investigation
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| GitHub | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.main:jenkins-core | <2.32.2 >=2.34, <2.44 |
2.32.2 2.44 |
Affected products
- [UNKNOWN] jenkins
Classification
- Weakness
- Technology feeds
References
-
github.com
/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b
web, patch
-
jenkins.io
/security/advisory/2017-02-01/
vendor-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=CVE-2017-2598
web, issue-tracking
-
securityfocus.com
/bid/95948
vdb-entry, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2017-2598
advisory
-
github.com
/jenkinsci/jenkins
package
-
jenkins.io
/security/advisory/2017-02-01
web
Sources
- CVE List CVE-2017-2598
- GitHub Advisory GHSA-r9q2-3r6x-qmgp
- NVD CVE-2017-2598
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.