CVEvulnerability
CVE-2017-1000353
CISA Known Exploited Vulnerability
Jenkins Remote Code Execution Vulnerability — Jenkins Jenkins
Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
- Added to KEV
- 2025-10-02
- Remediation due
- 2025-10-23
- Ransomware use
- Unknown
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Notes
- https://www.jenkins.io/security/advisory/2017-04-26/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-1000353
- Status
- Analyzed
- Published
- 2018-01-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-502
Description
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
Affected configurations
• jenkins jenkins (<= 2.56)
• jenkins jenkins (<= 2.46.1)
• oracle communications cloud native core automated test suite 1.9.0
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.html Permissions Required, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/98056 Broken Link
- https://jenkins.io/security/advisory/2017-04-26/ Vendor Advisory
- https://www.exploit-db.com/exploits/41965/ Exploit, Third Party Advisory, VDB Entry
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.html Permissions Required, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/98056 Broken Link
- https://jenkins.io/security/advisory/2017-04-26/ Vendor Advisory
- https://www.exploit-db.com/exploits/41965/ Exploit, Third Party Advisory, VDB Entry
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-1000353 US Government Resource