CVE-2017-1000353

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.htmlPermissions Required, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/98056Broken Link
https://jenkins.io/security/advisory/2017-04-26/Vendor Advisory
https://www.exploit-db.com/exploits/41965/Exploit, Third Party Advisory, VDB Entry
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.htmlPermissions Required, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/98056Broken Link
https://jenkins.io/security/advisory/2017-04-26/Vendor Advisory
https://www.exploit-db.com/exploits/41965/Exploit, Third Party Advisory, VDB Entry
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-1000353US Government Resource

Timeline

Published: Jan 29, 2018
Last modified: Jun 17, 2026
Added to CISA KEV: Oct 2, 2025
NVD status: Analyzed

Related CVEs from 2017

CVE-2017-10003548.8Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkin CVE-2017-10003556.5Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void CVE-2017-10003568.8Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication r CVE-2017-10003577.5Denial of Service attack when the switch rejects to receive packets from the controller. Component: This vulnerability affects OpenDaylight CVE-2017-10003586.5Controller throws an exception and does not allow user to add subsequent flow for a particular switch. Component: OpenDaylight odl-restconf CVE-2017-10003595.3Java out of memory error and significant increase in resource consumption. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw CVE-2017-10003605.3StreamCorruptedException and NullPointerException in OpenDaylight odl-mdsal-xsql. Controller launches exceptions in the console. Component: CVE-2017-10003617.5DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight. Controller launches exceptions and consumes more CVE-2017-10003629.8The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a back CVE-2017-10003637.8Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr integer is static, a 'secure boot'CVE-2017-10003647.4An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can b CVE-2017-10003657.8The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the