CVE-2017-2598: Inadequate Encryption Strength in Jenkins
Summary
CVE-2017-2598: Inadequate Encryption Strength in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.32.2
>= 2.34, < 2.44
Fixed in 2.32.2 or 2.44, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that helps in building, testing, and deploying software projects. It is widely used for continuous integration and delivery. The vulnerable package in focus is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its main functionality.
Vulnerability Detail
The vulnerability (CVE-2017-2598) in Jenkins versions before 2.44 and 2.32.2 arises from the use of AES ECB block cipher mode without an initialization vector (IV) for encrypting secrets. This inadequate encryption strength exposes Jenkins and the stored secrets to unnecessary risks. An attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive information.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.32.22.32.2 -
>= 2.34, < 2.442.44
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed versions as mentioned above.
Conclusion
Inadequate encryption strength in Jenkins versions before 2.44 and 2.32.2 poses a security risk by using AES ECB block cipher mode without an IV for encrypting secrets. Upgrading to the fixed versions is crucial to ensure proper encryption and protection of sensitive information. For any further assistance, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
This vulnerability exposes Jenkins and the stored secrets to unnecessary risks. An attacker could potentially gain unauthorized access to sensitive information.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
There are no known exploits for this vulnerability at the moment. However, it is important to address the issue promptly by upgrading to the fixed versions.
The recommended approach is to upgrade Jenkins to the fixed versions. Mitigating the risk without upgrading may require implementing custom encryption mechanisms, which can be complex and error-prone.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.