Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext

CRITICAL 9.8CVE-2017-1000245 · GHSA-5gmf-8gh2-hhfp · Published 01/11/2017 · updated 17/06/2026

In short

CVE-2017-1000245 is a CRITICAL (CVSS 9.8) vulnerability affecting org.jenkins-ci.plugins:ssh, org.jvnet.hudson.plugins:ssh, ssh (jenkins).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 73.3% of all vulnerabilities.
Fix: update to 2.5 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:ssh Maven	`< 2.5`	`2.5`
org.jvnet.hudson.plugins:ssh Maven	`≤ 2.3`	No fix yet
ssh jenkins	`≤ 2.4`	No fix yet

Description

The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-1000245 · ADVISORY
jenkins.io/security/advisory/2017-07-10 · WEB
jenkins.io/security/advisory/2017-07-10 · Third Party Advisory

More vulnerabilities in org.jenkins-ci.plugins:ssh

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:ssh

Maven

< 2.5

2.5

org.jvnet.hudson.plugins:ssh

Maven

≤ 2.3

No fix yet

ssh

jenkins

≤ 2.4

No fix yet

Description

NVD description

More vulnerabilities in org.jenkins-ci.plugins:ssh

See all →