Last year, news of compromised passwords being used for accounts able to distribute NPM packages made the rounds. Their system looks similar to how publishing of plugins works in the Jenkins project: Accounts are protected by passwords chosen by users. Individual contributors have permission to release the components they maintain. The components they release are used by millions of developers around the world to deliver their software. In other...

This is a post about a major change in Jenkins, which is available starting from Jenkins 2.102 and Jenkins LTS 2.107.1. This is a change with a serious risk of regressions in plugins. If you are a Jenkins administrator, please read this blogpost and upgrade guidelines BEFORE upgrading. I would like to provide some heads-up about the JEP-200 change, which is included into the new Jenkins LTS 2.107.x baseline. Background For many years Jenkins...

We just released security updates to Jenkins, versions 2.107 and 2.89.4, that fix multiple security vulnerabilities. For an overview of what was fixed, see the security advisory. For an overview on the possible impact of these changes on upgrading Jenkins LTS, see our LTS upgrade guide. While the severity score works out as medium for all the vulnerabilities, we strongly recommend that anyone operating publicly accessible Jenkins...

Multiple Jenkins plugins received updates today that fix several security vulnerabilities. Android Lint CCM Credentials Binding JUnit Pipeline: Supporting APIs For an overview of these security fixes, see the security advisory. Subscribe to the jenkinsci-advisories mailing list to receive important future notifications related to Jenkins security....

There is a newer version of the announcement for Jenkins administrators. Please see this blogpost. Overview JEP-200 has been integrated into Jenkins weekly builds and (if all goes well) will be a part of the next LTS line. In a nutshell, this change is a security hardening measure to be less permissive about deserializing Java classes defined in the Java Platform or libraries bundled with Jenkins. For several years now, Jenkins...

We just released security updates to Jenkins, versions 2.95 and 2.89.2, that fix two security vulnerabilities. For an overview of what was fixed, see the security advisory. We usually announce core security updates well in advance on the jenkinsci-advisories mailing list, to give Jenkins administrators time to schedule a maintenance. Additionally, we try to align security updates with the regular LTS schedule. We have chosen not to do...

We just released security updates to Jenkins, versions 2.89 and 2.73.3, that fix two low-severity security vulnerabilities. For an overview of what was fixed, see the security advisory. For an overview on the possible impact of these changes on upgrading Jenkins LTS, see our LTS upgrade guide. Subscribe to the jenkinsci-advisories mailing list to receive important notifications related to Jenkins security....

Multiple Jenkins plugins received updates today that fix several security vulnerabilities. Active Choices (uno-choice) Build-Publisher Dependency Graph Viewer global-build-stats Additionally, the Multijob Plugin also received a security update several weeks ago. For an overview of these security fixes, see the security advisory. Active Choices Plugin distribution had been suspended since April due to its mandatory dependency on the suspended Scriptler Plugin. That dependency has been made optional, so Active Choices can be...

We just released security updates to Jenkins, versions 2.84 and 2.73.2, that fix several security vulnerabilities. Additionally, we published a new release of Swarm Plugin whose client contains a security fix, and Maven Plugin 3.0 was recently released to resolve a security issue. Users of Swarm Plugin and Maven Plugin should update these to their respective newest versions. For an overview of what was fixed, see the...

Multiple Jenkins plugins received updates today that fix several security vulnerabilities, including multiple high severity ones. We strongly recommend updating the following plugins as soon as possible: Blue Ocean Pipeline: Groovy Plugin Script Security Plugin Less severe security updates have been released for these plugins: Config File Provider Plugin Datadog Plugin Deploy to container Plugin DRY Plugin Pipeline: Input Step Plugin Static Analysis Utilities Plugin Additionally, the OWASP Dependency-Check Plugin recently also received a security update. For...