CVSS 3.0
4.3 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2017-2598
Medium (4.3) in jenkins jenkins. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.main:jenkins-core 2.32.2, 2.44.
Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-11-01)
- CWEs
- CWE-326, CWE-325
- Published
- Modified
- Record from
- the NVD, synced
Affected
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r9q2-3r6x-qmgp | Maven | org.jenkins-ci.main:jenkins-core | <2.32.2 | 2.32.2 |
| GHSA-r9q2-3r6x-qmgp | Maven | org.jenkins-ci.main:jenkins-core | >=2.34 <2.44 | 2.44 |