# CVE-2024-23898, CVE-2023-27899 and CVE-2023-43496 vulnerabilities on jenkins/jenkins:2.448-alpine-jdk17 **URL:** \ **Category:** Community\ **Tags:** question\ **Created:** [March 11, 2024, 7:18pm UTC](https://community.jenkins.io/t/cve-2024-23898-cve-2023-27899-and-cve-2023-43496-vulnerabilities-on-jenkins-jenkins-2-448-alpine-jdk17/13220 "2024-03-11T19:18:38Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![pruthvi-axle](https://avatars.discourse-cdn.com/v4/letter/p/bcef8e/32.png) [@pruthvi-axle](https://community.jenkins.io/u/pruthvi-axle)\ **Post date:** [March 11, 2024, 7:18pm UTC](https://community.jenkins.io/t/cve-2024-23898-cve-2023-27899-and-cve-2023-43496-vulnerabilities-on-jenkins-jenkins-2-448-alpine-jdk17/13220/1 "2024-03-11T19:18:38Z")
Hi Team, We are using Jenkins in our organization. Pulled latest image jenkins/jenkins:2.448-alpine-jdk17 from docker hub and performed Snyk scan and it reports CVE-2024-23898, CVE-2023-27899 and CVE-2023-43496 High vulnerabilities on jenkins/jenkins:2.448-alpine-jdk17 image. Can any one please help us resolving above vulnerabilities or any image with no vulnerabilities. Regards, Pruthvi. ---
**Author:** ![danielbeck](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/danielbeck/32/89_2.png) [@danielbeck](https://community.jenkins.io/u/danielbeck)\ **Post date:** [March 11, 2024, 7:31pm UTC](https://community.jenkins.io/t/cve-2024-23898-cve-2023-27899-and-cve-2023-43496-vulnerabilities-on-jenkins-jenkins-2-448-alpine-jdk17/13220/2 "2024-03-11T19:31:35Z")
Have you looked at what those vulnerabilities are before asking? That might give you a hint. ---
**Author:** ![pruthvi-axle](https://avatars.discourse-cdn.com/v4/letter/p/bcef8e/32.png) [@pruthvi-axle](https://community.jenkins.io/u/pruthvi-axle)\ **Post date:** [March 11, 2024, 7:46pm UTC](https://community.jenkins.io/t/cve-2024-23898-cve-2023-27899-and-cve-2023-43496-vulnerabilities-on-jenkins-jenkins-2-448-alpine-jdk17/13220/3 "2024-03-11T19:46:05Z")
Yes @danielbeck, couple of then are reporting for default file permissions and one is reporting for CLI WebSocket validation. ---
**Author:** ![danielbeck](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/danielbeck/32/89_2.png) [@danielbeck](https://community.jenkins.io/u/danielbeck)\ **Post date:** [March 11, 2024, 7:48pm UTC](https://community.jenkins.io/t/cve-2024-23898-cve-2023-27899-and-cve-2023-43496-vulnerabilities-on-jenkins-jenkins-2-448-alpine-jdk17/13220/4 "2024-03-11T19:48:08Z")
Right. And what’s the vulnerable component? And who published those CVEs? ---
**Author:** ![pruthvi-axle](https://avatars.discourse-cdn.com/v4/letter/p/bcef8e/32.png) [@pruthvi-axle](https://community.jenkins.io/u/pruthvi-axle)\ **Post date:** [March 12, 2024, 3:58pm UTC](https://community.jenkins.io/t/cve-2024-23898-cve-2023-27899-and-cve-2023-43496-vulnerabilities-on-jenkins-jenkins-2-448-alpine-jdk17/13220/5 "2024-03-12T15:58:11Z")
Hi @danielbeck, I see those vulnerabilities belongs to security component and published by NIST (NVD) ---
**Author:** ![Vlatombe](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/vlatombe/32/493_2.png) [@Vlatombe](https://community.jenkins.io/u/Vlatombe)\ **Post date:** [March 12, 2024, 4:30pm UTC](https://community.jenkins.io/t/cve-2024-23898-cve-2023-27899-and-cve-2023-43496-vulnerabilities-on-jenkins-jenkins-2-448-alpine-jdk17/13220/6 "2024-03-12T16:30:28Z")
Don’t blindly trust scanners… Just taking the first CVE, you can quickly find > **[Jenkins Security Advisory 2024-01-24](https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315)** > > Jenkins – an open source automation server which enables developers around the world to reliably build, test, and deploy their software ---
**Author:** ![danielbeck](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/danielbeck/32/89_2.png) [@danielbeck](https://community.jenkins.io/u/danielbeck)\ **Post date:** [March 13, 2024, 9:17am UTC](https://community.jenkins.io/t/cve-2024-23898-cve-2023-27899-and-cve-2023-43496-vulnerabilities-on-jenkins-jenkins-2-448-alpine-jdk17/13220/7 "2024-03-13T09:17:47Z")
No, they’re all published by the Jenkins project. Specifically, me. NVD just takes our content and republishes it with their own “enhancements”. And while NVD content is often wrong, even they don’t claim that 2.448 is affected. Either you’re actually scanning a different image (and then I would expect other results as well), or Snyk is pretty badly wrong. ---
**Author:** ![danielbeck](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/danielbeck/32/89_2.png) [@danielbeck](https://community.jenkins.io/u/danielbeck)\ **Post date:** [March 13, 2024, 9:31am UTC](https://community.jenkins.io/t/cve-2024-23898-cve-2023-27899-and-cve-2023-43496-vulnerabilities-on-jenkins-jenkins-2-448-alpine-jdk17/13220/8 "2024-03-13T09:31:58Z")
In this case, Snyk is _obviously_ wrong. For example, [Origin Validation Error in org.jenkins-ci.main:jenkins-core | CVE-2024-23898 | Snyk](https://security.snyk.io/vuln/SNYK-JAVA-ORGJENKINSCIMAIN-6191175) links to [[SECURITY-3315] · jenkinsci/jenkins@de45096 · GitHub](https://github.com/jenkinsci/jenkins/commit/de450967f38398169650b55c002f1229a3fcdb1b) which looks like this: > ![Screenshot 2024-03-13 at 10.31.02](https://europe1.discourse-cdn.com/flex013/uploads/jenkins/original/2X/6/6282eae6d82fdd5c5da6e56356b6fa8e2fd72b2f.png) Fix information in Snyk simply cannot be trusted. And it’s not just _outdated_: The statement that the fix is on `master` but unreleased was _never_ true, as the release is always published before the commit.