[JIRA] (JENKINS-59552) Detached plugins installed are those with security warnings

[awiddersheim@hotmail.com (JIRA)]

Andrew Widdersheim created an issue

Jenkins / JENKINS-59552 Detached plugins installed are those with security warnings Issue Type: Bug Assignee: Carlos Sanchez Components: docker Created: 2019-09-26 15:27 Priority: Critical Reporter: Andrew Widdersheim When running Jenkins with the official Docker container, some plugins will pull in detached plugins that have security vulnerabilities and also have newer versions available that could be used instead. To replicate, you can install https://plugins.jenkins.io/purge-build-queue-plugin# for example. This will pull in a vulnerable version of https://plugins.jenkins.io/pam-auth: jenkins_1 | INFO: Loading a detached plugin as a dependency: /var/jenkins_home/plugins/pam-auth.jpi jenkins_1 | WARNING: Created /var/jenkins_home/plugins/pam-auth/WEB-INF/lib/classes.jar; update plugin to a version created with a newer harness jenkins_1 | INFO: Took 0ms for Loading plugin PAM Authentication plugin v1.1 (pam-auth) by pool-6-thread-4 jenkins_1 | INFO: Took 0ms for Initializing plugin pam-auth by pool-6-thread-1 According to Jesse Glick, this is a bug and not intended behavior.  This might be scoped to just running with Docker but it's the only place I'm able to test and replicate. Add Comment

This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f)

[jglick@cloudbees.com (JIRA)]

Jesse Glick updated an issue

Jenkins / JENKINS-59552 Detached plugins installed are those with security warnings

Change By: Jesse Glick Component/s: core Component/s: docker

Add Comment

[jglick@cloudbees.com (JIRA)]

Jesse Glick updated an issue

Jenkins / JENKINS-59552 Detached plugins installed are those with security warnings

Change By: Jesse Glick Labels: security

Add Comment

[jglick@cloudbees.com (JIRA)]

Jesse Glick assigned an issue to Unassigned

Jenkins / JENKINS-59552 Detached plugins installed are those with security warnings

Change By: Jesse Glick Assignee: Carlos Sanchez

Add Comment

[dbeck@cloudbees.com (JIRA)]

Daniel Beck commented on JENKINS-59552

Re: Detached plugins installed are those with security warnings Andrew Widdersheim Sorry about the lack of responses, I was busy. Happy to take this, unless you want to?

Add Comment

[awiddersheim@hotmail.com (JIRA)]

Andrew Widdersheim commented on JENKINS-59552

Re: Detached plugins installed are those with security warnings

Go for it. I'm busy too.

Add Comment

[dbeck@cloudbees.com (JIRA)]

Daniel Beck assigned an issue to Daniel Beck

Jenkins / JENKINS-59552

Detached plugins installed are those with security warnings

Change By: Daniel Beck Assignee: Daniel Beck

Add Comment

[dbeck@cloudbees.com (JIRA)]

Daniel Beck started work on JENKINS-59552

Change By: Daniel Beck Status: Open In Progress

Add Comment

[dbeck@cloudbees.com (JIRA)]

Daniel Beck closed an issue as Fixed

Should be in 2.198.

Jenkins / JENKINS-59552 Detached plugins installed are those with security warnings

Change By: Daniel Beck Status: In Progress Closed Resolution: Fixed Released As: jenkins-2.198

Add Comment