Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-65281

Update to xstream 1.4.16 to avoid security scanner complaints

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Minor Minor
    • core
    • 2.285

      The xstream 1.4.16 release resolves security vulnerabilities when unmarshalling with an XStream instance using an uninitialized security framework. As far as I can tell, Jenkins is not susceptible to the vulnerabilities being fixed in xstream 1.4.16. It would be good to include the xstream 1.4.16 in the Jenkins 2.277.x line (like 2.277.3 being released in May) so that security scanners do not need to be taught that Jenkins is not susceptible to the issue in xstream 1.4.15 and earlier.

      See https://github.com/jenkinsci/jenkins/pull/5360 for the delivery of that change into Jenkins 2.285

          [JENKINS-65281] Update to xstream 1.4.16 to avoid security scanner complaints

          Daniel Beck added a comment -

          The filter needs issues to be resolved.

          Daniel Beck added a comment - The filter needs issues to be resolved.

            Unassigned Unassigned
            markewaite Mark Waite
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: