We strive to fix all security vulnerabilities in Jenkins and plugins in a timely manner. However, the structure of the Jenkins project, which gives plugin maintainers a lot of autonomy, and the number and diversity of plugins make this impossible to guarantee.
In case of a plugin vulnerability, we try to contact the plugin maintainer(s) to inform them of it. If they decline (or otherwise fail) to fix the vulnerability, or don’t respond in a timely manner, and the security team doesn’t have the capacity to fix it, we follow the process outlined below in the interest of our users:
Publish a security advisory about the plugin, describing the nature of the vulnerability, but noting that there is no fix other than no longer using the plugin. If there are workarounds, explain them.
In some cases of high severity vulnerabilities, stop publishing the vulnerable plugin on the Jenkins update sites.
Add metadata to the plugin site indicating vulnerable plugins to inform administrators who may already have the plugin installed.
Some maintainers end up fixing security vulnerabilities after we have announced it as unresolved in their plugin. This can be any time between hours and years after publication.
In those cases, security advisories will not be amended, as the information provided was correct at the time of publication. Additionally, the security advisory will be clear that the lack of a fix is only known "as of publication of this advisory".
We will update the security warnings metadata that is shown to administrators in Jenkins and on the plugins site. Maintainers can inform us through Jira or email about a fix or file a pull request updating the warnings metadata themselves. Once we confirm the fix is correct and complete, we will update the published warnings metadata. This will remove the active security warning from the plugin entry on the plugins site and from the plugin manager directly in Jenkins.
Distribution of the following plugins was suspended in conjunction with the publication of a security advisory announcing unresolved security issues. The Jenkins security team believes that most use cases would be negatively impacted by these security vulnerabilites and it is better for the Jenkins ecosystem to no longer distribute these plugins in their current form to prevent harm to users. This typically is the case when plugins have particularly severe security vulnerabilities, deliberately bypass or disable protection mechanisms, or offer little benefit to users anyway.
Adaptive DSL (AdaptivePlugin): SECURITY-457
batch task (batch-task): SECURITY-1025
Build Flow (build-flow-plugin): SECURITY-293
CAS protocol version 1 (cas1): SECURITY-491
Copy To Slave (copy-to-slave): SECURITY-545
CryptoMove (cryptomove): SECURITY-1635
CVS Tagging (cvs-tag): SECURITY-459
Debian Package Builder (debian-package-builder): SECURITY-2546
Dynamic Parameter (dynamicparameter): SECURITY-462
ElasticBox Jenkins Kubernetes CI/CD (kubernetes-ci): SECURITY-1738
Grails (grails): SECURITY-458
GroovyAxis (groovyaxis): SECURITY-460
JS Games (jsgames): SECURITY-1905
Kubernetes :: Pipeline :: Arquillian Steps (kubernetes-pipeline-arquillian-steps): SECURITY-920 (2)
Kubernetes :: Pipeline :: Kubernetes Steps (kubernetes-pipeline-steps): SECURITY-920 (1)
Literate (literate): SECURITY-1750
Nerrvana (nerrvana): SECURITY-2097
Persona (persona): SECURITY-2046
Pipeline: Classpath Step (pipeline-classpath): SECURITY-336
Publish Over SSH (publish-over-ssh): various vulnerabilities announced on 2022-01-12
Puppet Enterprise Pipeline (puppet-enterprise-pipeline): SECURITY-918
Reactor (reactor): SECURITY-487
Script SCM (scriptscm): SECURITY-461
scripttrigger: SECURITY-456
Simple Travis Pipeline Runner (simple-travis-runner): SECURITY-922
Speaks! (speaks): SECURITY-623
Subversion Tagging (svn-tag): SECURITY-298
tcl: SECURITY-379
Unless the security issue is inherent to what the plugin does while not making this the sole purpose of the plugin, the Jenkins security team welcomes efforts to fix the vulnerabilities and have plugin distribution restored.
In addition to plugins suspended for security reasons, the following plugins that require suspended plugins to run are also suspended, as they would not be installable:
Build Automation Management Tool (build-configurator) depends on copy-to-slave
build-flow-extensions-plugin depends on build-flow-plugin
build-flow-test-aggregator depends on build-flow-plugin
build-flow-toolbox-plugin depends on build-flow-plugin
External Resource Dispatcher (externalresource-dispatcher) depends on build-flow-plugin
Kubernetes :: Pipeline :: Aggregator (kubernetes-pipeline-aggregator) depends on kubernetes-pipeline-arquillian-steps and kubernetes-pipeline-steps
lsf-cloud depends on copy-to-slave
SGE Cloud Plugin (sge-cloud-plugin) depends on copy-to-slave
XTrigger (xtrigger) depends on scripttrigger