CVE-2017-1000353: Deserialization of Untrusted Data in Jenkins
Summary
CVE-2017-1000353: Deserialization of Untrusted Data in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.46.2
>= 2.50, < 2.57
Fixed in 2.46.2 or 2.57, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of features and plugins to support continuous integration and delivery. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core'.
Vulnerability Detail
Jenkins versions 2.56 and earlier, as well as 2.46.1 LTS and earlier, are susceptible to an unauthenticated remote code execution vulnerability. Attackers can exploit this vulnerability by sending a serialized Java 'SignedObject' object to the Jenkins CLI, which is then deserialized using a new 'ObjectInputStream'. This bypasses the existing blacklist-based protection mechanism. The impact of this vulnerability is severe, as it allows remote code execution without authentication.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.46.22.46.2 -
>= 2.50, < 2.572.57
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to apply the recommended fixes and updates to ensure the security of the Jenkins installation.
Conclusion
The vulnerability in Jenkins allows unauthenticated remote code execution, posing a significant security risk. It is crucial to update Jenkins to the recommended versions and disable the remoting-based CLI protocol to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery of software projects.
The vulnerable package is 'org.jenkins-ci.main:jenkins-core'.
The vulnerability allows unauthenticated remote code execution, which can lead to unauthorized access and potential compromise of the Jenkins server.
To fix this vulnerability, update Jenkins to the recommended versions mentioned earlier and disable the remoting-based CLI protocol.
There is no specific workaround provided. It is essential to apply the recommended fixes and updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
