CVE-2017-1000362

The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup directory with all old secrets, and the key used to encrypt them. These backups were world-readable and not removed afterwards. Jenkins now deletes the backup directory, if present. Upgrading from before 1.498 will no longer create a backup directory. Administrators relying on file access permissions in their manually created backups are advised to check them for the directory $JENKINS_HOME/jenkins.security.RekeySecretAdminMonitor/backups, and delete it if present.

• CWE-200

• https://jenkins.io/security/advisory/2017-02-01/Vendor Advisory
• https://jenkins.io/security/advisory/2017-02-01/Vendor Advisory

Published

Jul 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000356Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and …
• CVE-2017-1000357Denial of Service attack when the switch rejects to receive …
• CVE-2017-1000358Controller throws an exception and does not allow user to ad…
• CVE-2017-1000359Java out of memory error and significant increase in resourc…
• CVE-2017-1000360StreamCorruptedException and NullPointerException in OpenDay…
• CVE-2017-1000361DOMRpcImplementationNotAvailableException when sending Port-…
• CVE-2017-1000363Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missin…7.8
• CVE-2017-1000364An issue was discovered in the size of the stack guard page …
• CVE-2017-1000365The Linux Kernel imposes a size restriction on the arguments…7.8
• CVE-2017-1000366glibc contains a vulnerability that allows specially crafted…
• CVE-2017-1000367Todd Miller's sudo version 1.8.20 and earlier is vulnerable …
• CVE-2017-1000368Todd Miller's sudo version 1.8.20p1 and earlier is vulnerabl…