GHSA-r9q2-3r6x-qmgpMediumCVSS 4.3

Inadequate Encryption Strength in Jenkins

Published
May 13, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2017-2598 →

📋 Description

Jenkins before versions 2.44 and 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).

🎯 Affected products2

  • maven/org.jenkins-ci.main:jenkins-core:<= 2.32.1
  • maven/org.jenkins-ci.main:jenkins-core:>= 2.34, <= 2.43

🔗 References (5)