CVE-2017-1000353

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.

• CWE-502
• CWE-502

• http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.htmlPermissions Required, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/98056Broken Link
• https://jenkins.io/security/advisory/2017-04-26/Vendor Advisory
• https://www.exploit-db.com/exploits/41965/Exploit, Third Party Advisory, VDB Entry
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.htmlPermissions Required, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/98056Broken Link
• https://jenkins.io/security/advisory/2017-04-26/Vendor Advisory
• https://www.exploit-db.com/exploits/41965/Exploit, Third Party Advisory, VDB Entry
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-1000353US Government Resource

Published

Jan 29, 2018

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000253Linux distributions that have not patched their long-term ke…7.8
• CVE-2017-1000254libcurl may read outside of a heap allocated buffer when doi…
• CVE-2017-1000255On Linux running on PowerPC hardware (Power8 or later) a use…
• CVE-2017-1000256libvirt version 2.3.0 and later is vulnerable to a bad defau…8.1
• CVE-2017-1000257An IMAP FETCH response line indicates the size of the return…9.1
• CVE-2017-10003Vulnerability in the Solaris component of Oracle Sun Systems…
• CVE-2017-1000354Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and …
• CVE-2017-1000355Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and …
• CVE-2017-1000356Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and …
• CVE-2017-1000357Denial of Service attack when the switch rejects to receive …
• CVE-2017-1000358Controller throws an exception and does not allow user to ad…
• CVE-2017-1000359Java out of memory error and significant increase in resourc…