We just released security updates to Jenkins, versions 2.95 and 2.89.2, that fix two security vulnerabilities. For an overview of what was fixed, see the security advisory. We usually announce core security updates well in advance on the jenkinsci-advisories mailing list, to give Jenkins administrators time to schedule a maintenance. Additionally, we try to align security updates with the regular LTS schedule. We have chosen not to do so in this case for two reasons: The random failure to set up Jenkins is very noticeable, and given that we’ve seen automated exploits for unprotected Jenkins instances in the past we consider it important to fix that issue as soon as possible, so that users setting up new instances of Jenkins can be confident they won’t start up insecurely. The CSRF issue appears to only affect instances for a very short (seconds at most, if at all) time period immediately after startup, so administrators could apply the fix during the next scheduled Jenkins downtime, rather than immediately.

We just released security updates to Jenkins, versions 2.89 and 2.73.3, that fix two low-severity security vulnerabilities. For an overview of what was fixed, see the security advisory. For an overview on the possible impact of these changes on upgrading Jenkins LTS, see our LTS upgrade guide. Subscribe to the jenkinsci-advisories mailing list to receive important notifications related to Jenkins security.

Multiple Jenkins plugins received updates today that fix several security vulnerabilities. Active Choices (uno-choice) Build-Publisher Dependency Graph Viewer global-build-stats Additionally, the Multijob Plugin also received a security update several weeks ago. For an overview of these security fixes, see the security advisory. Active Choices Plugin distribution had been suspended since April due to its mandatory dependency on the suspended Scriptler Plugin. That dependency has been made optional, so Active Choices can be used without having Scriptler installed. This means we are able to resume distribution of Active Choices Plugin again. It should be available on update sites later today. We also announced a medium severity security vulnerability in SCP publisher plugin that does not have a fix at this time. Subscribe to the jenkinsci-advisories mailing list to receive important future notifications related to Jenkins security.

We just released security updates to Jenkins, versions 2.84 and 2.73.2, that fix several security vulnerabilities. Additionally, we published a new release of Swarm Plugin whose client contains a security fix, and Maven Plugin 3.0 was recently released to resolve a security issue. Users of Swarm Plugin and Maven Plugin should update these to their respective newest versions. For an overview of what was fixed, see the security advisory. For an overview on the possible impact of these changes on upgrading Jenkins LTS, see our LTS upgrade guide. We also published information about a vulnerability in Speaks! Plugin. There is no fix available and we recommend it be uninstalled. Its distribution has been suspended. Subscribe to the jenkinsci-advisories mailing list to receive important notifications related to Jenkins security.

Multiple Jenkins plugins received updates today that fix several security vulnerabilities, including multiple high severity ones. We strongly recommend updating the following plugins as soon as possible: Blue Ocean Pipeline: Groovy Plugin Script Security Plugin Less severe security updates have been released for these plugins: Config File Provider Plugin Datadog Plugin Deploy to container Plugin DRY Plugin Pipeline: Input Step Plugin Static Analysis Utilities Plugin Additionally, the OWASP Dependency-Check Plugin recently also received a security update. For an overview of what was fixed, see the security advisory. Subscribe to the jenkinsci-advisories mailing list to receive important future notifications related to Jenkins security.

Multiple Jenkins plugins received updates today that fix several security vulnerabilities, including high severity ones: Docker Commons Plugin Git Plugin GitHub Branch Source Plugin Parameterized Trigger Plugin Periodic Backup Plugin Pipeline: Build Step Plugin Pipeline: Groovy Plugin Poll SCM Plugin Role-based Authorization Strategy Plugin Script Security Plugin Sidebar Link Plugin Subversion Plugin Additionally, the SSH Plugin received a security update a few days ago. For an overview of what was fixed, see the security advisory. Subscribe to the jenkinsci-advisories mailing list to receive important notifications related to Jenkins security.

As in previous years, there’ll be a contributor summit at Jenkins World 2017 : Let’s talk about the future of Jenkins and how you can help shape it! The contributor summit is the place where the current and future contributors of the Jenkins project get together. This year, the theme is “working together”. Traditionally, most contributors are plugin maintainers focusing on their own plugins, but it’s important to look at Jenkins as a whole, because that’s how users experience it. There is more to the project beyond writing plugins, and even for plugin developers, there are increasing number of common libraries and modules that plugins should rely on. In short, we should work better together. A few contributors will prepare some presentations to help clarify what that means, and what all of us can do. And in the afternoon, there will be "unconference" sessions to brainstorm and discuss what we can do and how. Whether you are already a contributor or just thinking about becoming one, please join us for this full day free event. Details about this year’s agenda are available on the event’s meetup page. Attending is free, and no Jenkins World ticket is needed, but RSVP if you’re going to attend to help us plan. See you there!

We just released security updates to Jenkins, versions 2.57 and 2.46.2, that fix several security vulnerabilities, including a critical one. That critical vulnerability is an unauthenticated remote code execution via the remoting-based CLI. When I announced the fix for the previous vulnerability of this kind, I announced our plans to revisit the design of the CLI that enabled this class of vulnerabilities. Since Jenkins 2.54, we now have a new CLI implementation that isn’t based on remoting, and deprecated its remoting mode. Despite it being a major feature, we decided to backport it to 2.46.2, so LTS users can also disable the unsafe remoting mode while retaining almost all of the CLI’s existing functionality. For an overview of what was fixed, see the security advisory. For an overview on the possible impact of these changes on upgrading Jenkins LTS, see our LTS upgrade guide. I recommend you read these documents, especially if you’re using the CLI with Jenkins LTS, as there are possible side effects of these fixes. Subscribe to the jenkinsci-advisories mailing list to receive important notifications related to Jenkins security.