We just released security updates to Jenkins, versions 2.154 and LTS 2.150.1, that fix multiple security vulnerabilities. Since 2.150.1 is the first release in the new LTS line, we also released 2.138.4, a security update for the previous LTS line. This allows administrators to install today’s security fixes without having to upgrade to the new LTS line immediately. For an overview of what was fixed, see the...

In a past blog post, Delivery Pipelines, with Jenkins 2, SonarQube, and Artifactory, we talked about pipelines which result in binaries for development versions, and in Delivery pipelines, with Jenkins 2: how to promote Java EE and Docker binaries toward production, we examined ways to consistently promote applications toward production. In this blog post, I continue on both by discussing more details on security related quality gates and bringing...

We just released security updates to Jenkins, versions 2.146 and 2.138.2, that fix multiple security vulnerabilities. For an overview of what was fixed, see the security advisory. For an overview on the possible impact of these changes on upgrading Jenkins LTS, see our LTS upgrade guide. Further improvements In addition to the security fixes listed in the security advisory, we also applied multiple improvements that make future security...

We just released security updates to Jenkins, versions 2.138 and 2.121.3, that fix multiple security vulnerabilities. For an overview of what was fixed, see the security advisory. For an overview on the possible impact of these changes on upgrading Jenkins LTS, see our LTS upgrade guide. Subscribe to the jenkinsci-advisories mailing list to receive important notifications related to Jenkins security....

We just released security updates to Jenkins, versions 2.133 and 2.121.2, that fix multiple security vulnerabilities. For an overview of what was fixed, see the security advisory. For an overview on the possible impact of these changes on upgrading Jenkins LTS, see our LTS upgrade guide. Subscribe to the jenkinsci-advisories mailing list to receive important notifications related to Jenkins security....

About API tokens Jenkins API tokens are an authentication mechanism that allows a tool (script, application, etc.) to impersonate a user without providing the actual password for use with the Jenkins API or CLI. This is especially useful when your security realm is based on a central directory, like Active Directory or LDAP, and you don’t want to store your password in scripts. Recent versions of Jenkins also make...

(adapted from this blog post by Daniel Nurmi) As more and more Jenkins users ship docker containers, it is worth thinking about the security implications of this model, where the variance in software being included by developers has increased dramatically from previous models. Security implications in this context include what makes up the image, but also the components of the app that get bundled into...

We just released security updates to Jenkins, versions 2.121 and 2.107.3, that fix multiple security vulnerabilities. Additionally, we announce previously published security issues and corresponding fixes in these plugins: Black Duck Hub Groovy Postbuild Gitlab Hook (fix unreleased) For an overview of what was fixed, see the security advisory. For an overview on the possible impact of these changes on upgrading Jenkins LTS, see our LTS upgrade guide. Subscribe to the...

We just released security updates to Jenkins, versions 2.116 and 2.107.2, that fix two security vulnerabilities. For an overview of what was fixed, see the security advisory. Subscribe to the jenkinsci-advisories mailing list to receive important notifications related to Jenkins security....

Last year, news of compromised passwords being used for accounts able to distribute NPM packages made the rounds. Their system looks similar to how publishing of plugins works in the Jenkins project: Accounts are protected by passwords chosen by users. Individual contributors have permission to release the components they maintain. The components they release are used by millions of developers around the world to deliver their software. In other...