GHSA-r9q2-3r6x-qmgp

ghsaUSosv

Inadequate Encryption Strength in Jenkins

view advisory published 2022-05-13Licence: CC-BY-4.0

Jenkins before versions 2.44 and 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-2598US	medium4.3	1.04% (64th)	—	2018-05-23
Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SE…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2598WEB
https://github.com/jenkinsci/jenkinsPACKAGE
https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28bWEB
https://jenkins.io/security/advisory/2017-02-01WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-2598ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan