https://bugzilla.redhat.com/show_bug.cgi?id=1446114
--- Comment #5 from Jason Shepherd jshepherd@redhat.com --- To expand on the last comment. The rpm jenkins-2.46.3-1.el7.noarch included in this image, [1] was released after 2.46.2, and would be considered a newer release then Jenkins LTS 2.46.1
From, https://jenkins.io/doc/book/managing/cli/
"Use of the CLI client distributed with Jenkins 2.53 and older and Jenkins LTS 2.46.1 and older is not recommended for security reasons: while there are no currently known vulnerabilities, several have been reported and patched in the past, and the Jenkins Remoting protocol it uses is inherently vulnerable to remote code execution bugs, even “preauthentication” exploits (by anonymous users able to physically access the Jenkins network)."
I would consider CVE-2017-1000353 a "known vulnerability" by the definition in this paragraph.
[1] https://access.redhat.com/containers/?tab=security#/registry.access.redhat.c...