CVE-2017-1000353criticalunder attackCWE-502

CVE-2017-1000353

Published · Updated

Follow this CVE+ Monitor Jenkins+ Monitor org.jenkins-ci.main:jenkins-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDJan 29
1st PoCMay 5
metasploitApr 26
CISA KEV+2803d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product
Red Hat OpenShift Enterprise 2
no_fix_planned: Will not fix
Not affected
1 product (2 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Enterprise 3
Action required by CISAfederal deadline: 2025-10-23

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Jenkins versions before 2.57 and 2.46.2 LTS allowed attackers to run arbitrary code without authentication by sending specially crafted serialized Java objects through the CLI. This is critical because Jenkins often has access to sensitive credentials and system resources.

Technical detail

An unauthenticated remote code execution vulnerability in Jenkins CLI exploits unsafe Java deserialization via ObjectInputStream. Attackers bypass the blacklist-based protection by sending a SignedObject payload, achieving arbitrary code execution with Jenkins process privileges. The fix adds SignedObject to the deserialization blacklist and deprecates the remoting-based CLI protocol in favor of HTTP-based CLI.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.