Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-68096

Current version of Extended Choice Parameter has multiple vulnerabilities

XMLWordPrintable

      The current version of this plugin contains multiple vulnerabilities:

      This is displayed on the plugin page as well as warning within the Jenkins UI itself.

          [JENKINS-68096] Current version of Extended Choice Parameter has multiple vulnerabilities

          Jesse Jarzynka created issue -
          Jesse Jarzynka made changes -
          Priority Original: Minor [ 4 ] New: Major [ 3 ]
          Kalle Niemitalo made changes -
          Link New: This issue relates to JENKINS-26683 [ JENKINS-26683 ]

          Alan Sparks added a comment -

          Is a resolution going to happen for this bug anytime soon?

          Alan Sparks added a comment - Is a resolution going to happen for this bug anytime soon?

          iyad omry added a comment -

          This is a very important plugin for us, whet it will be fixed?

           

          iyad omry added a comment - This is a very important plugin for us, whet it will be fixed?  

          Steven Visagie added a comment -

          Is there an ETA for vulnerability remediation? We use this plugin extensively and would try find a way to remove it (e.g. replace with other parameter types) but some other critical plugins we use (e.g. Custom Tools) depend on it as well.

          Steven Visagie added a comment - Is there an ETA for vulnerability remediation? We use this plugin extensively and would try find a way to remove it (e.g. replace with other parameter types) but some other critical plugins we use (e.g. Custom Tools) depend on it as well.
          Donal Hunt made changes -
          Labels New: Security security

          Gabe Ortiz added a comment -

          4 vulnerabilities now.

          Gabe Ortiz added a comment - 4 vulnerabilities now. CSRF vulnerability and missing permission checks allow SSRF Arbitrary JSON and property file read vulnerability Stored XSS vulnerability Stored XSS vulnerability

          Alexander Brandes added a comment -

          chas Did already address a few security vulnerabilities. To silence the warnings in the update center, the maintainer needs to file a pull request to the update center updating the version range the security vulnerability used to affect.

          Alexander Brandes added a comment - chas Did already address a few security vulnerabilities. To silence the warnings in the update center, the maintainer needs to file a pull request to the update center updating the version range the security vulnerability used to affect.
          Charles made changes -
          Assignee Original: vimil [ vimil ] New: Charles [ chas ]

            chas Charles
            jessejoe Jesse Jarzynka
            Votes:
            11 Vote for this issue
            Watchers:
            21 Start watching this issue

              Created:
              Updated: