Inadequate Encryption Strength in Jenkins - CVE-2017-2598
Published: May 23, 2018 / Updated: July 17, 2020
Vulnerability identifier: #VU31294
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-2598
CWE-ID: CWE-326
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Jenkins
Affected software:
Jenkins
Jenkins
Detailed vulnerability description
The vulnerability allows a remote authenticated user to gain access to sensitive information.
Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).
How to mitigate CVE-2017-2598
Install update from vendor's website.