CVE-2017-1000355: Deserialization of Untrusted Data in Jenkins
Summary
CVE-2017-1000355: Deserialization of Untrusted Data in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.46.2
>= 2.50, < 2.57
Fixed in 2.46.2 or 2.57, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It is widely used in the software development industry for continuous integration and delivery. The vulnerable package in focus is 'org.jenkins-ci.main:jenkins-core'. This package is a core component of Jenkins and provides essential functionality for its operation.
Vulnerability Detail
The vulnerability identified as CVE-2017-1000355 affects Jenkins versions 2.56 and earlier, as well as 2.46.1 LTS and earlier. It is categorized as a moderate-level vulnerability with a CVSS score of 6.5. The vulnerability arises from a flaw in the XStream library used by Jenkins, which can lead to a Java crash when attempting to instantiate void/Void. This vulnerability can be exploited by an attacker who can provide untrusted data to the affected Jenkins instance, potentially leading to denial of service or other malicious activities.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.46.22.46.2 -
>= 2.50, < 2.572.57
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrade is not feasible, a temporary workaround can be implemented by disabling the XStream serialization feature in Jenkins. This can be achieved by setting the system property 'hudson.remoting.ClassFilter.DEFAULT' to 'true' in the Jenkins master JVM. However, this workaround may impact certain functionality that relies on XStream serialization.
Conclusion
The vulnerability CVE-2017-1000355 in Jenkins exposes the software to potential exploitation through untrusted data deserialization. It is crucial to apply the recommended fixes by upgrading to the patched versions. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery in software development.
The impacted package is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins.
Jenkins versions 2.56 and earlier, as well as 2.46.1 LTS and earlier, are affected.
This vulnerability is classified as moderate, with a CVSS score of 6.5.
To fix this vulnerability, it is recommended to upgrade Jenkins to the specified patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
