CVE-2017-1000396: Improper Certificate Validation in Jenkins
Summary
CVE-2017-1000396: Improper Certificate Validation in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.73.2
>= 2.74, < 2.84
Fixed in 2.73.2 or 2.84, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It is widely used in the software development industry for continuous integration and delivery. The Jenkins core package, specifically the 'jenkins-core' module, is responsible for the fundamental functionality of the Jenkins server. This vulnerability affects versions 2.73.1 and earlier, as well as 2.83 and earlier, of the 'jenkins-core' package.
Vulnerability Detail
The vulnerability, identified as CVE-2017-1000396, stems from the inclusion of an outdated version of the commons-httpclient library in Jenkins. This library, used as a transitive dependency in Jenkins plugins, contained a flaw (CVE-2012-6153) that resulted in improper validation of SSL certificates. As a consequence, the affected Jenkins instances were susceptible to man-in-the-middle attacks. The vulnerability's severity is rated as MODERATE with a CVSS score of 5.9.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.73.22.73.2 -
>= 2.74, < 2.842.84
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can manually update the commons-httpclient library used by their Jenkins plugins to a version that includes the fix for CVE-2012-6153. This can be achieved by modifying the plugin's dependencies in the respective pom.xml file. Below is an example of how the dependency can be updated:
<dependency>
<groupId>commons-httpclient</groupId>
<artifactId>commons-httpclient</artifactId>
<version>3.1</version>
</dependency>
Conclusion
In conclusion, the vulnerability CVE-2017-1000396 in Jenkins arises from the improper certificate validation in the bundled commons-httpclient library. It is crucial to update the 'jenkins-core' package to the recommended versions or manually update the commons-httpclient library in affected plugins. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery in software development.
The 'jenkins-core' package is a fundamental module of Jenkins that provides core functionality to the Jenkins server.
CVE-2017-1000396 is the identifier for the vulnerability in Jenkins that involves improper certificate validation.
This vulnerability could allow attackers to perform man-in-the-middle attacks on affected Jenkins instances.
To fix this vulnerability, update the 'jenkins-core' package to the recommended versions mentioned in the 'how_to_fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
