CVE-2017-2608: Deserialization of Untrusted Data in Jenkins
Summary
CVE-2017-2608: Deserialization of Untrusted Data in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.32.2
>= 2.34, < 2.44
Fixed in 2.32.2 or 2.44, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It is widely used for continuous integration and delivery. The vulnerable package in focus is 'org.jenkins-ci.main:jenkins-core'. This package is a core component of Jenkins and provides essential functionality for its operation.
Vulnerability Detail
The vulnerability identified as CVE-2017-2608 involves the deserialization of untrusted data in Jenkins. Specifically, it affects the handling of various types in javax.imageio within XStream-based APIs. This vulnerability can be exploited remotely and may lead to remote code execution. An attacker could potentially execute arbitrary code on the Jenkins server, compromising its integrity and potentially gaining unauthorized access to sensitive information.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.32.22.32.2 -
>= 2.34, < 2.442.44
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate package update is not feasible, a possible workaround is to disable the affected functionality or restrict access to the Jenkins server. This can be achieved by modifying the server's configuration to disable or limit the usage of javax.imageio or the XStream-based APIs. However, this workaround may impact the functionality of certain features or plugins dependent on the vulnerable package.
Conclusion
In conclusion, the vulnerability CVE-2017-2608 in Jenkins exposes the server to remote code execution through the deserialization of untrusted data. It is crucial to update the 'org.jenkins-ci.main:jenkins-core' package to version 2.32.2 or higher to mitigate this vulnerability. If immediate update is not possible, consider applying workarounds to limit the impact. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery. It helps developers automate the building, testing, and deployment of software projects.
The 'org.jenkins-ci.main:jenkins-core' package is a core component of Jenkins that provides essential functionality for its operation. It is responsible for managing the core features and services of the Jenkins server.
Deserialization is the process of converting serialized data (e.g., in XML or JSON format) back into its original object representation. In the context of this vulnerability, it refers to the handling of untrusted serialized data, which can lead to code execution if not properly validated.
This vulnerability can be exploited remotely by sending maliciously crafted serialized data to the vulnerable Jenkins server. If the server deserializes this data without proper validation, it may execute arbitrary code provided by the attacker.
The potential consequences of this vulnerability include remote code execution on the Jenkins server, unauthorized access to sensitive information, and compromise of the server's integrity. It can also be used as a stepping stone for further attacks within the network.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
