Description
Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | jenkins | jenkins 2.44, jenkins 2.32.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.32.2 | 2.32.2 | GHSA-r9q2-3r6x-qmgp |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.34, < 2.44 | 2.44 | GHSA-r9q2-3r6x-qmgp |