Inadequate Encryption Strength in Jenkins

2022-05-1301:36:56

Google

osv.dev

0.001 Low

EPSS

Percentile

43.4%

JSON

Jenkins before versions 2.44 and 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).

CPENameOperatorVersion
org.jenkins-ci.main:jenkins-coreeq1.500
org.jenkins-ci.main:jenkins-coreeq1.571
org.jenkins-ci.main:jenkins-coreeq1.622
org.jenkins-ci.main:jenkins-coreeq1.596.1
org.jenkins-ci.main:jenkins-coreeq1.510
org.jenkins-ci.main:jenkins-coreeq1.616
org.jenkins-ci.main:jenkins-coreeq1.566
org.jenkins-ci.main:jenkins-coreeq1.447
org.jenkins-ci.main:jenkins-coreeq1.416
org.jenkins-ci.main:jenkins-coreeq2.25

Name	Operator	Version
org.jenkins-ci.main:jenkins-core	eq	1.500
org.jenkins-ci.main:jenkins-core	eq	1.571
org.jenkins-ci.main:jenkins-core	eq	1.622
org.jenkins-ci.main:jenkins-core	eq	1.596.1
org.jenkins-ci.main:jenkins-core	eq	1.510
org.jenkins-ci.main:jenkins-core	eq	1.616
org.jenkins-ci.main:jenkins-core	eq	1.566
org.jenkins-ci.main:jenkins-core	eq	1.447
org.jenkins-ci.main:jenkins-core	eq	1.416
org.jenkins-ci.main:jenkins-core	eq	2.25