Repository navigation
[JENKINS-66507] update xstream to 1.4.18 #12154
Description
#5685 updated XStream (Jenkins 2.309 and higher).
The library has a public CVE and whilst Jenkins already uses an allow list so is not impacted it would be nice to pull this update into the LTS version to keep some scanners happy.
This is a retrospective ticket that was assigned after the fact to start an LTS backport discussion.
See also https://groups.google.com/g/jenkinsci-dev/c/jX0f6Kz6zhc
Originally reported by 
teilo, imported from: update xstream to 1.4.18
- status: Resolved
- priority: Minor
- component(s): core
- label(s): 2.303.2-fixed
- resolution: Fixed
- resolved: 2021-08-31T14:05:51+00:00
- votes: 0
- watchers: 1
- imported: 2025-11-24
Raw content of original issue
#5685 updated XStream (Jenkins 2.309 and higher).
The library has a public CVE and whilst Jenkins already uses an allow list so is not impacted it would be nice to pull this update into the LTS version to keep some scanners happy.
This is a retrospective ticket that was assigned after the fact to start an LTS backport discussion.
See also https://groups.google.com/g/jenkinsci-dev/c/jX0f6Kz6zhc
Activity
jenkins-infra-bot commentedon Aug 31, 2021
Remote link associated with this issue: