High
Security advisory
Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs (SECURITY-383).
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-2608
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 09:56 UTC · Revision 1
Source evidence
Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs (SECURITY-383).
osv:CVE-2017-2608
Complete source record
{
"id": "d5a6acd75afb1ac9acda647bbac1af35b66525060e39ed7db0cf52911dfdee62",
"url": "https://osv.dev/vulnerability/CVE-2017-2608",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-2608",
"summary": "Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs (SECURITY-383).",
"evidence": "osv:CVE-2017-2608",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2017-2608",
"aliases": [
"CVE-2017-2608",
"GHSA-fwqr-3pvp-pjwq"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/jenkinsci/jenkins",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "5828e963ac26f209298c3fdfb7a3a49f2cc401d4"
},
{
"fixed": "4992b15066ecd87428dcd204102f1158bbcc8b3a"
},
{
"fixed": "a814154695e23dc37542af7d40cacc129cf70722"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.44"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.32.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "a814154695e23dc37542af7d40cacc129cf70722"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"jenkins-2.44",
"jenkins-2.37",
"jenkins-2.36",
"jenkins-2.35",
"jenkins-2.34",
"jenkins-2.32",
"jenkins-2.33",
"jenkins-2.31",
"jenkins-2.30",
"jenkins-2.29",
"jenkins-2.28",
"jenkins-2.27",
"jenkins-2.26",
"jenkins-2.25",
"jenkins-2.24",
"jenkins-2.23",
"jenkins-2.22",
"jenkins-2.21",
"jenkins-2.19",
"jenkins-2.20",
"jenkins-2.18",
"jenkins-2.17",
"jenkins-2.16",
"jenkins-2.15",
"jenkins-2.14",
"jenkins-2.13",
"jenkins-2.12",
"jenkins-2.11",
"jenkins-2.10",
"jenkins-2.9",
"jenkins-2.7",
"jenkins-2.8",
"jenkins-2.6",
"jenkins-2.5",
"jenkins-2.4",
"jenkins-2.3",
"jenkins-1.656",
"jenkins-1.655",
"jenkins-1.654",
"jenkins-1.651",
"jenkins-1.653",
"jenkins-1.652",
"jenkins-1.650",
"jenkins-1.649",
"jenkins-1.648",
"builds/341",
"jenkins-1.647",
"changes/371",
"builds/371",
"jenkins-1.646",
"jenkins-1.645",
"jenkins-1.644",
"jenkins-1.642",
"jenkins-1.643",
"changes/372",
"builds/372",
"changes/370",
"builds/370",
"jenkins-1.641",
"jenkins-1.625.3",
"jenkins-1.640",
"jenkins-1.639",
"jenkins-1.625.3-rc1",
"jenkins-1.625.2",
"jenkins-1.638",
"jenkins-1.625.1-rc2",
"jenkins-1.625.1-rc1",
"jenkins-1.625",
"jenkins-1.628",
"jenkins-1.627",
"jenkins-1.626",
"jenkins-1.608",
"jenkins-1.624",
"jenkins-1.623",
"jenkins-1.622",
"jenkins-1.621",
"jenkins-1.620",
"changes/363",
"builds/363",
"jenkins-1.619",
"jenkins-1.618",
"jenkins-1.617",
"jenkins-1.616",
"jenkins-1.615",
"jenkins-1.614",
"jenkins-1.610",
"changes/361",
"builds/361",
"builds/358",
"builds/359",
"jenkins-1.609",
"changes/358",
"changes/357",
"changes/356",
"builds/357",
"builds/356",
"jenkins-1.607",
"jenkins-1.606",
"builds/355",
"changes/353",
"builds/353",
"jenkins-1.605",
"changes/352",
"builds/352",
"jenkins-1.604",
"changes/350",
"builds/350",
"changes/348",
"builds/348",
"changes/346",
"builds/346",
"changes/345",
"builds/345",
"changes/344",
"builds/344",
"changes/343",
"builds/343",
"changes/342",
"builds/342",
"changes/339",
"builds/339",
"changes/340",
"builds/340",
"changes/338",
"builds/338",
"changes/133",
"builds/133",
"changes/306",
"builds/306",
"changes/305",
"builds/305",
"changes/304",
"builds/304",
"changes/303",
"builds/303",
"changes/302",
"builds/302",
"changes/301",
"changes/300",
"changes/299",
"builds/301",
"builds/300",
"builds/299",
"changes/298",
"changes/297",
"builds/298",
"builds/297",
"changes/296",
"builds/296",
"changes/295",
"builds/295",
"changes/294",
"builds/294",
"changes/293",
"builds/293",
"changes/291",
"builds/291",
"changes/276",
"builds/276",
"changes/290",
"builds/290",
"changes/288",
"builds/288",
"changes/287",
"builds/287",
"changes/286",
"builds/286",
"changes/282",
"builds/282",
"builds/285",
"changes/284",
"builds/284",
"changes/281",
"builds/281",
"changes/280",
"builds/280",
"changes/279",
"builds/279",
"changes/278",
"builds/278",
"changes/277",
"builds/277",
"changes/275",
"builds/275",
"changes/274",
"builds/274",
"changes/273",
"builds/273",
"changes/272",
"builds/272",
"changes/271",
"builds/271",
"changes/270",
"builds/270",
"changes/269",
"builds/269",
"changes/268",
"builds/268",
"changes/267",
"builds/267",
"changes/266",
"builds/266",
"changes/265",
"builds/265",
"builds/264",
"changes/262",
"builds/262",
"builds/260",
"changes/259",
"builds/259",
"changes/258",
"builds/258",
"changes/257",
"builds/257",
"changes/256",
"builds/256",
"changes/255",
"builds/255",
"builds/254",
"changes/251",
"builds/251",
"changes/250",
"builds/250",
"changes/249",
"builds/249",
"changes/248",
"builds/248",
"builds/247",
"changes/245",
"builds/245",
"changes/244",
"builds/244",
"changes/243",
"builds/243",
"changes/242",
"builds/242",
"changes/241",
"builds/241",
"changes/240",
"builds/240",
"changes/239",
"builds/239",
"changes/238",
"builds/238",
"changes/228",
"builds/228",
"changes/237",
"builds/237",
"changes/236",
"builds/236",
"changes/235",
"builds/235",
"changes/234",
"builds/234",
"changes/233",
"builds/233",
"changes/232",
"builds/232",
"changes/231",
"builds/231",
"changes/210",
"builds/210",
"changes/230",
"builds/230",
"changes/229",
"builds/229",
"changes/126",
"builds/126",
"builds/227",
"changes/225",
"builds/225",
"changes/224",
"builds/224",
"changes/223",
"builds/223",
"changes/222",
"builds/222",
"changes/221",
"builds/221",
"changes/220",
"builds/220",
"builds/219",
"changes/218",
"builds/218",
"changes/217",
"builds/217",
"changes/216",
"builds/216",
"changes/215",
"builds/215",
"changes/214",
"builds/214",
"changes/213",
"builds/213",
"changes/212",
"builds/212",
"changes/211",
"builds/211",
"changes/209",
"builds/209",
"changes/207",
"builds/207",
"changes/206",
"builds/206",
"changes/205",
"builds/205",
"changes/204",
"builds/204",
"changes/203",
"builds/203",
"changes/202",
"builds/202",
"changes/201",
"builds/201",
"changes/200",
"builds/200",
"changes/199",
"builds/199",
"changes/198",
"builds/198",
"changes/197",
"builds/197",
"changes/196",
"builds/196",
"changes/195",
"builds/195",
"changes/194",
"builds/194",
"changes/193",
"builds/193",
"changes/192",
"builds/192",
"changes/191",
"builds/191",
"changes/190",
"builds/190",
"changes/189",
"builds/189",
"changes/188",
"builds/188",
"changes/187",
"builds/187",
"changes/186",
"builds/186",
"changes/185",
"builds/185",
"changes/184",
"builds/184",
"changes/183",
"builds/183",
"changes/182",
"builds/182",
"changes/181",
"builds/181",
"changes/180",
"builds/180",
"changes/179",
"builds/179",
"changes/177",
"builds/177",
"changes/176",
"builds/176",
"changes/174",
"builds/174",
"changes/173",
"builds/173",
"changes/172",
"builds/172",
"changes/171",
"builds/171",
"changes/170",
"builds/170",
"changes/169",
"builds/169",
"builds/168",
"builds/166",
"builds/165",
"changes/166",
"changes/165",
"changes/164",
"builds/164",
"changes/163",
"builds/163",
"changes/162",
"builds/162",
"changes/161",
"builds/161",
"builds/160",
"changes/158",
"builds/158",
"changes/157",
"builds/157",
"changes/156",
"builds/156",
"changes/155",
"builds/155",
"changes/154",
"builds/154",
"changes/148",
"builds/148",
"changes/153",
"builds/153",
"changes/152",
"builds/152",
"changes/151",
"builds/151",
"changes/150",
"builds/150",
"changes/149",
"builds/149",
"changes/147",
"builds/147",
"changes/146",
"changes/145",
"builds/146",
"builds/145",
"changes/144",
"builds/144",
"changes/143",
"builds/143",
"changes/142",
"builds/142",
"changes/141",
"builds/141",
"changes/140",
"builds/140",
"changes/139",
"changes/138",
"builds/139",
"builds/138",
"changes/137",
"builds/137",
"changes/136",
"builds/136",
"changes/135",
"builds/135",
"changes/134",
"builds/134",
"changes/132",
"builds/132",
"changes/131",
"builds/131",
"changes/44",
"builds/44",
"changes/130",
"builds/130",
"changes/128",
"builds/128",
"changes/127",
"builds/127",
"changes/125",
"builds/125",
"changes/124",
"builds/124",
"changes/123",
"builds/123",
"changes/122",
"builds/122",
"changes/121",
"builds/121",
"changes/120",
"builds/120",
"changes/119",
"builds/119",
"changes/118",
"builds/118",
"changes/117",
"builds/117",
"changes/116",
"builds/116",
"changes/115",
"builds/115",
"changes/114",
"builds/114",
"changes/113",
"builds/113",
"builds/112",
"changes/110",
"builds/110",
"changes/109",
"builds/109",
"changes/108",
"builds/108",
"changes/107",
"builds/107",
"changes/106",
"builds/106",
"changes/105",
"builds/105",
"changes/104",
"builds/104",
"changes/103",
"builds/103",
"changes/102",
"builds/102",
"changes/101",
"builds/101",
"changes/94",
"builds/94",
"changes/93",
"builds/93",
"changes/92",
"builds/92",
"changes/90",
"builds/90",
"changes/89",
"builds/89",
"changes/86",
"builds/86",
"changes/85",
"builds/85",
"changes/83",
"builds/83",
"changes/41",
"builds/41",
"changes/82",
"builds/82",
"changes/81",
"builds/81",
"changes/79",
"changes/77",
"builds/77",
"changes/76",
"changes/56",
"builds/56",
"changes/55",
"builds/55",
"changes/54",
"builds/54",
"changes/53",
"builds/53",
"changes/52",
"builds/52",
"changes/51",
"builds/51",
"changes/50",
"builds/50",
"changes/49",
"builds/49",
"changes/48",
"builds/48",
"changes/47",
"builds/47",
"changes/46",
"builds/46",
"changes/43",
"changes/42",
"builds/43",
"builds/42",
"changes/40",
"builds/40",
"changes/39",
"builds/39",
"changes/37",
"builds/37",
"changes/36",
"builds/36",
"changes/35",
"builds/35",
"changes/34",
"builds/34",
"builds/33",
"changes/32",
"builds/32",
"changes/31",
"builds/31",
"changes/30",
"builds/30",
"changes/29",
"builds/29",
"changes/28",
"builds/28",
"changes/27",
"builds/27",
"builds/26",
"changes/24",
"builds/24",
"changes/23",
"builds/23",
"changes/22",
"builds/22",
"changes/21",
"builds/21",
"changes/20",
"changes/18",
"builds/18",
"changes/17",
"builds/17",
"changes/16",
"builds/16",
"changes/2",
"builds/2",
"1.328-rc",
"1.327-rc",
"1.325-rc",
"1.324-rc"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-2608.json"
}
}
],
"modified": "2026-10-20T10:48:49.695004134Z",
"provider": "osv",
"references": [
"https://jenkins.io/security/advisory/2017-02-01/",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2608",
"https://github.com/jenkinsci/jenkins/commit/a814154695e23dc37542af7d40cacc129cf70722"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2017-2608",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 380374,
"published_at": "2018-05-15T20:29:00.277+00:00"
}