v1.25 🐛

Important security fixes, see the Jenkins security advisory here. This release might be incompatible with previous ones for some use-cases, documentation and mitigation are available below.

🐛 Bug Fixes

• SECURITY-1279 / CVE-2019-10343 - Prevent exposing secrets from some plugins as plain text in System logs when loading configs. @oleg-nenashev
  • Known affected plugin configurations: password for UsernamePasswordCredentialsImpl from the Credentials plugin, private key for BasicSSHUserPrivateKey from the SSH Credentials plugin, SMTP password in the Mail Ext Plugin
• SECURITY-1290 / CVE-2019-10344 - Do not allow users without Overall/Administer permission to access instance-specific documentation and JSON schema. @varyvol
• SECURITY-1446 / CVE-2019-10362 - Escape Jenkins system configuration variables to prevent their resolution when importing configs. @fcojfernandez @oleg-nenashev
  • See the documentation here
• SECURITY-1458 / CVE-2019-10363 - Prevent exposing secrets from some plugins as plain text in exported YAMLs. @oleg-nenashev
  • Known affected plugin configurations: password in the SGE Cloud Plugin

💥 Breaking changes

• Jenkins admins might need to review the configuration YAML files and to manually escape Jenkins internal variable expressions. See the documentation here
• If anonymous API access is used to access configuration specification or JSON Schema,
  Jenkins admins need to reconfigure the client logic to authenticate as users
  with administrative access (e.g. using an access token)

🚦 Tests

• SECURITY-1303 / CVE-2019-10345 - Add integration test to verify the fix @oleg-nenashev
• Add LoggerRule asserts to io.jenkins.plugins.casc.misc.Util @oleg-nenashev
• Add exportToString() method for YAML export tesing to JenkinsConfiguredWithCodeRule @oleg-nenashev