Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).
[
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"file": "core/src/main/java/jenkins/security/CryptoConfidentialKey.java"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-06766944",
"digest": {
"threshold": 0.9,
"line_hashes": [
"305930840073233313123990364924610852800",
"100644309666103830509496003903036411659",
"313292731240792924623784985188605567372",
"108882712108668736939852602260158592270",
"149121414583155512218669212473278056799",
"250757757161727948415098803085282142960",
"30062542598841474569723778500396641052",
"119576118030318236888166482175989254773",
"121546935809640601845767623099006375051",
"55361232763776155559235829702719287466",
"172981307834300264250726167084180319968",
"168045766569962511172611379438404464692",
"263047235748066449811532123098487566990",
"112474894046403871779152076070222012955",
"234545489481274616858647802257592980873",
"79692683047230020514320084758904897986",
"60675184202234922548961561113243509180",
"209460712172585494472994539575026201258",
"113195073649416367237167774633643284306",
"88348961859958872857767726866082519414",
"14179938515306383417474225906630870030",
"15916279158638679346064015611078678101",
"234078675171227240707539746729492422892",
"156166100799398120780489712239861768694",
"204988234880346263708383618020948153885",
"176358385314685072692360450268969632166"
]
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"function": "decrypt",
"file": "core/src/main/java/jenkins/security/CryptoConfidentialKey.java"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-105ad956",
"digest": {
"length": 214.0,
"function_hash": "178256409736214979409355304043010861470"
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"function": "getEncryptedValue",
"file": "core/src/main/java/hudson/util/Secret.java"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-262f8113",
"digest": {
"length": 308.0,
"function_hash": "165424836621897746741884565636234253993"
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"function": "verifyRewrite",
"file": "test/src/test/java/jenkins/security/RekeySecretAdminMonitorTest.java"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-4c031f83",
"digest": {
"length": 216.0,
"function_hash": "330607929831063614150581042292122657403"
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"file": "test/src/test/java/lib/form/PasswordTest.java"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-59335bc8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"292850070707343144351431530280666686303",
"308044210002267469415417156876138737276",
"121072328190602009224634822675984923794",
"245271826491785023594386187532326382415",
"202022143650792085784476165375378305035",
"97771546760145790436599389798953138114",
"26828177916945003614276279480349379813",
"324096270216040387283087269494087711365",
"304606942987393169855477498063129906694",
"190146291131391555301173190917746572985",
"264018051519231566346011122547649554004",
"105073235807074478318240048638162457808",
"113754311809707387942615065180270050155",
"71709773217189607385060612693942280862",
"181508857781612092153158622625866356940",
"12902642626946056654147404084300622349",
"41740308938485563498010196107298452889",
"38563025274070683664323925376715419504",
"49354449380397009256747378159454397432",
"331220007398456206018667314982883420477",
"146957598012947898264866828182328376810",
"265242560357755784598970641515928612682",
"314466722840285422853669442417410391083",
"88060203327963095130040511989052923999",
"129824265909121034815818034491736839540",
"4908159761260956310653610720156700710",
"121977149501748468060138055911135149463",
"239692844036686056903046113715130965775",
"57154870667515740060968211013622087797",
"170651440340779813827584627708905929915",
"126148306384147410453115761200196652722",
"293099863535944301099257682154496257215",
"312707754615937307372440783266349942766",
"182843428834920096089439853430967728537",
"34270051259597902512653610220737128491",
"212179698281365517995769480808661878507",
"3547048814652970554946693417293357036",
"307002954280285568828721645459981883228"
]
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"function": "getKey",
"file": "core/src/main/java/jenkins/security/CryptoConfidentialKey.java"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-75a5a6ed",
"digest": {
"length": 410.0,
"function_hash": "125283907686778558164068681576281705040"
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"file": "core/src/main/java/hudson/util/SecretRewriter.java"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-823560da",
"digest": {
"threshold": 0.9,
"line_hashes": [
"106408138319883536945882098640894873154",
"71533143255427233937060512688579391252",
"41530346151740525616002343149702549308",
"225807873219130633742915241656476853375",
"302022528013118328010972825242232557682",
"238373161063521608065538046931034466454",
"212627756188674952140787056772373058421",
"54474097477615317311179774595292977953"
]
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"function": "SecretRewriter",
"file": "core/src/main/java/hudson/util/SecretRewriter.java"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-8af81472",
"digest": {
"length": 117.0,
"function_hash": "115877833107357959520839674034878927897"
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"function": "getLegacyKey",
"file": "core/src/main/java/hudson/util/Secret.java"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-9afe70ca",
"digest": {
"length": 174.0,
"function_hash": "325053493821840845664075416200084660247"
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"function": "decrypt",
"file": "core/src/main/java/hudson/util/Secret.java"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-a4b2cd27",
"digest": {
"length": 509.0,
"function_hash": "180425839949994333081042184033730948197"
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"function": "testExposedCiphertext",
"file": "test/src/test/java/lib/form/PasswordTest.java"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-ae9c36db",
"digest": {
"length": 3241.0,
"function_hash": "119708651988034455660723248229168229852"
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"file": "core/src/main/java/hudson/util/Secret.java"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-bbb60371",
"digest": {
"threshold": 0.9,
"line_hashes": [
"108778818747154763912411705374200843333",
"32814171857699789234983362796491440335",
"83582254124193301484055635715482484252",
"287059441794560341823316998649643659493",
"294403974051299171607325668528707530088",
"78350342083934280480464066081412774846",
"70118911270177300713463695631126743449",
"294574030278181506619639696431386880077",
"290311530173164268922655019495086776861",
"102103038129357179595235162207365790385",
"31874088406163539236482660250190194998",
"317029369170599907332184045558601457489",
"49400514978174794283618774480213932147",
"307789000055070314248633822747437860231",
"230476944425008866187334851880094453498",
"47609479765175956042924154107481332676",
"204331064871461976181452003311709659470",
"271167311042152379196736935209572280615",
"185772671872972787730453198028200745338",
"4582878183913113557497335385793494686",
"238220214471275456847664026873630118346",
"224979638282744069404637404804949642331",
"21649299418901685771498744493797902191",
"13998444267587279842618120466194025017",
"234182299030466815333048324812324343481",
"218488892011837530629820829173596605541",
"273091483499970561009156497699760879833",
"230370306346559873411114134494710191923",
"14045415954648865942323821449042085288",
"270612321360226961401951678203335263606",
"274662182251227138474349022710656851979",
"161558788559515039550248412551623156649",
"14652033176071594424115999916651352439",
"81175363527838353513526151287363982297",
"186980193645824508187234161394888170528",
"229553523212673733416273056505447673874",
"241066512921928819052792525465155650669",
"69566145878603256091545058850095205109",
"335716370532802559553837978105470272093",
"45142951388858507441109861482213250650",
"55558652106880556703298820243207228958",
"226958288794547253355738673960887925777",
"112989781005170796170377811671998511462",
"209309321310697786719902723745566190950",
"336573598611442657031481612480907734203",
"10912935424914227633134981299675910476",
"93694958405299168480087244781999986789",
"150261084795625629560233429831412798537",
"201590903131862703273703053979004533611",
"206345718054997878249999670881546523441",
"230234388718581167904159616322234468531",
"325820235344789872637905772988411179724",
"13104509221417474918677809291695082852",
"278010993100689383938966047027922515959",
"330254640127954420530942751693769308492",
"222066494241333374166044425273239283553",
"77331399266922681318237145002631226599",
"256185226392959824761937526460003688610",
"81317095792430749414121051886991788478",
"308697555041124401665591724856850151426",
"24611969205046981243300495253705218010",
"313270826093689777018709525726558829807",
"129655140315413036593063116597004081319",
"38333929436334428045845350985038638878",
"72171639300466543008872798916276279455",
"212733705449188661777705008534988643650",
"127036494324107835007593284088170981095",
"212131025021380765194222956657463712781",
"67426103063149866038120018736221634209",
"283798439497888211746003078904834212795"
]
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"file": "test/src/test/java/jenkins/security/RekeySecretAdminMonitorTest.java"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-ce802f03",
"digest": {
"threshold": 0.9,
"line_hashes": [
"146265969059877492589145810004099763336",
"244047347682967846087061386173322727786",
"110211514801789698149132458306957193833",
"318756106178843010490038104744034713615",
"49748824931406049190045109612560891751",
"86584635276990748092065684377744259840",
"33488473700166129987741704222711253795",
"24918360031619479669997786789004024319",
"251568277355803251445594909731763690290",
"339546340710824123153831928740664825317",
"63408120097994420467351284773953136773",
"216793814520058723608354003728905438862",
"81435529772457388560165162310965105121",
"323138350416142002112366339575043407668",
"242516246369379033053865032192817498263",
"196891271952530223680658734919913750934"
]
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"function": "encrypt",
"file": "core/src/main/java/jenkins/security/CryptoConfidentialKey.java"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-d4a12ac4",
"digest": {
"length": 214.0,
"function_hash": "109922759028387727897896229694301971970"
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"function": "tryDecrypt",
"file": "core/src/main/java/hudson/util/Secret.java"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-e1d50562",
"digest": {
"length": 346.0,
"function_hash": "80144820035017481901147084775222631966"
}
},
{
"source": "https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b",
"target": {
"function": "tryRewrite",
"file": "core/src/main/java/hudson/util/SecretRewriter.java"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2017-2598-fca81e15",
"digest": {
"length": 447.0,
"function_hash": "276993342190714168868998899465521159785"
}
}
]