Jenkins官方于2018年5月9日发布最新
安全公告 ,本次发布的安全公告共包括了2个高危、3个中危、3个低危漏洞,具体漏洞详情参见官方公告介绍。
漏洞等级:
- SECURITY-771: medium
- SECURITY-786: low
- SECURITY-788: high
- SECURITY-794: low
- SECURITY-263: low
- SECURITY-670: medium
- SECURITY-671: high
- SECURITY-821: medium
受影响版本:
- Jenkins weekly up to and including 2.120
- Jenkins LTS up to and including 2.107.2
- Black Duck Hub Plugin up to and including 3.0.3
- Black Duck Hub Plugin up to and including 3.1.0
- Gitlab Hook Plugin up to and including 1.4.2
- Groovy Postbuild Plugin up to and including 2.3.1
已修复版本:
- Jenkins weekly should be updated to version 2.121
- Jenkins LTS should be updated to version 2.107.3
- Black Duck Hub Plugin should be updated to version 3.1.0
- Black Duck Hub Plugin should be updated to version 4.0.0
- Groovy Postbuild Plugin should be updated to version 2.4
安全建议:建议使用Jenkins用户尽快修复,升级到最新版本,并对Jenkins进行
安全加固 ,防止被黑客利用。
情报来源:
- https://jenkins.io/security/advisory/2018-05-09/