Multiple Jenkins plugins received updates today that fix several security vulnerabilities, including high severity ones: Docker Commons Plugin Git Plugin GitHub Branch Source Plugin Parameterized Trigger Plugin Periodic Backup Plugin Pipeline: Build Step Plugin Pipeline: Groovy Plugin Poll SCM Plugin Role-based Authorization Strategy Plugin Script Security Plugin Sidebar Link Plugin Subversion Plugin Additionally, the SSH Plugin received a security update a few days ago. For an overview of what was fixed, see the security advisory. Subscribe to the jenkinsci-advisories...

As in previous years, there’ll be a contributor summit at Jenkins World 2017: Let’s talk about the future of Jenkins and how you can help shape it! The contributor summit is the place where the current and future contributors of the Jenkins project get together. This year, the theme is “working together”. Traditionally, most contributors are plugin maintainers focusing on their own plugins, but it’s...

We just released security updates to Jenkins, versions 2.57 and 2.46.2, that fix several security vulnerabilities, including a critical one. That critical vulnerability is an unauthenticated remote code execution via the remoting-based CLI. When I announced the fix for the previous vulnerability of this kind, I announced our plans to revisit the design of the CLI that enabled this class of vulnerabilities. Since Jenkins 2.54, we now...

In response to the zero-day vulnerability we fixed in November, I wrote the following: Moving forward, the Jenkins security team is revisiting the design of the Jenkins CLI over the coming weeks to prevent this class of vulnerability in the future. If you are interested in participating in that discussion, please join in on the jenkinsci-dev@ mailing list. In early February, several project contributors met after FOSDEM...

These are not security fixes you can apply blindly. We strongly recommend you read this post, as well as the security advisory to understand what the vulnerabilities are, whether and how they affect you, and what to expect when upgrading plugins. Multiple Jenkins plugins received updates today that fix several security vulnerabilities or other security-related issues: Email Extension (Email-ext) Environment Injector (EnvInject) Extensible Choice Parameter Groovy Job DSL Lockable Resources Matrix Authorization Role...

Multiple Jenkins plugins received updates today that fix several security vulnerabilities: Active Directory Distributed Fork Email Extension (Email-ext) Mailer SSH Build Agents For an overview of what was fixed, see the security advisory. Additionally, we also published a security notice for the following plugin and recommend that users disable and uninstall it: Pipeline: Classpath Step This plugin is not part of the Pipeline suite of plugins, despite its name. It’s installed on just...

We just released security updates to Jenkins, versions 2.44 and 2.32.2, that fix a high severity and several medium and low severity issues. For an overview of what was fixed, see the security advisory. For an overview on the possible impact of these changes on upgrading Jenkins LTS, see our LTS upgrade guide. I strongly recommend you read these documents, as there are a few possible side...

Jenkins 2.40 was released earlier this week, and readers of the changelog will have noticed that it now includes the ability to show security warnings published by the configured update site. But what does that mean? In the past, we’ve notified users about security issues in Jenkins and in plugins through various means: Emails to the jenkinsci-advisories mailing list (which I recommend you subscribe to), blog posts, and, recently, emails...

A zero-day vulnerability in Jenkins was published on Friday, November 11. Last week we provided an immediate mitigation and today we are releasing updates to Jenkins which fix the vulnerability. We strongly recommend you update Jenkins to 2.32 (main line) or 2.19.3 (LTS) as soon as possible. Today’s security advisory contains more information on the exploit, affected versions, and fixed versions, but in short: An unauthenticated remote code execution vulnerability allowed attackers to transfer...

We created new native packages for Jenkins 2.7.1 today. These replace the existing packages. Due to a release process issue, the packaging (RPM, etc.) was created the same way as Jenkins 1.x LTS, resulting in problems starting Jenkins on some platforms: While we dropped support for AJP in Jenkins 2.0, some 1.x packages had it enabled by default, resulting in an exception during startup. These...