[JENKINS-25169] Winstone potentially vulnerable to POODLE (CVE-2014-3566) #23523

Activity

1. jenkins-infra-bot commented on Oct 16, 2014

   

   jenkins-infra-bot

   on Oct 16, 2014

   Author

   More actions

   scm_issue_link:

   • Original comment link
   • Raw content of original comment:

     Code changed in jenkins
     User: christ66
     Path:
      src/java/winstone/HttpsConnectorFactory.java
     http://jenkins-ci.org/commit/winstone/503ef47e817eda69fadf3e7e82aeded43409bb7f
     Log:
       [FIXED JENKINS-25169] Because of the POODLE vulnerability, we disabled SSLv3 by default.
     
     
     

   Code changed in jenkins
   User: christ66
   Path:
   src/java/winstone/HttpsConnectorFactory.java
   http://jenkins-ci.org/commit/winstone/503ef47e817eda69fadf3e7e82aeded43409bb7f
   Log:
   [FIXED JENKINS-25169] Because of the POODLE vulnerability, we disabled SSLv3 by default.
2. jenkins-infra-bot commented on Oct 16, 2014

   

   jenkins-infra-bot

   on Oct 16, 2014

   Author

   More actions

   scm_issue_link:

   • Original comment link
   • Raw content of original comment:

     Code changed in jenkins
     User: christ66
     Path:
      src/java/winstone/HttpsConnectorFactory.java
     http://jenkins-ci.org/commit/winstone/b73a8cdc4b351bf764982f1909fcf3c360925053
     Log:
       JENKINS-25169 Move exclude protocol to a better location.
     
     
     

   Code changed in jenkins
   User: christ66
   Path:
   src/java/winstone/HttpsConnectorFactory.java
   http://jenkins-ci.org/commit/winstone/b73a8cdc4b351bf764982f1909fcf3c360925053
   Log:
   JENKINS-25169 Move exclude protocol to a better location.
3. jenkins-infra-bot commented on Oct 16, 2014

   

   jenkins-infra-bot

   on Oct 16, 2014

   Author

   More actions

   kohsuke:

   • Original comment link
   • Raw content of original comment:

     Released as Winstone 2.7
     

   Released as Winstone 2.7
4. jenkins-infra-bot commented on Oct 16, 2014

   

   jenkins-infra-bot

   on Oct 16, 2014

   Author

   More actions

   scm_issue_link:

   • Original comment link
   • Raw content of original comment:

     Code changed in jenkins
     User: Kohsuke Kawaguchi
     Path:
      changelog.html
      war/pom.xml
     http://jenkins-ci.org/commit/jenkins/7c2254fbf8d643dc58673d01c97fd855f983d4bf
     Log:
       [FIXED JENKINS-25169]
     
     Integrated the new winstone.jar for 1.585
     
     
     

   Code changed in jenkins
   User: Kohsuke Kawaguchi
   Path:
   changelog.html
   war/pom.xml
   http://jenkins-ci.org/commit/jenkins/7c2254fbf8d643dc58673d01c97fd855f983d4bf
   Log:
   [FIXED JENKINS-25169]

   Integrated the new winstone.jar for 1.585
5. jenkins-infra-bot

   closed this as completedon Oct 16, 2014
6. jenkins-infra-bot commented on Oct 16, 2014

   

   jenkins-infra-bot

   on Oct 16, 2014

   Author

   More actions

   scm_issue_link:

   • Original comment link
   • Raw content of original comment:

     Code changed in jenkins
     User: Kohsuke Kawaguchi
     Path:
      war/pom.xml
     http://jenkins-ci.org/commit/jenkins/15fbd281b8df0a7894a0f4e6d2c65b0fbf0f8a87
     Log:
       [FIXED JENKINS-25169]
     
     Integrated the new winstone.jar for 1.580.1
     (cherry picked from commit 7c2254fbf8d643dc58673d01c97fd855f983d4bf)
     
     Conflicts:
     
     	changelog.html
     	war/pom.xml
     
     
     

   Code changed in jenkins
   User: Kohsuke Kawaguchi
   Path:
   war/pom.xml
   http://jenkins-ci.org/commit/jenkins/15fbd281b8df0a7894a0f4e6d2c65b0fbf0f8a87
   Log:
   [FIXED JENKINS-25169]

   Integrated the new winstone.jar for 1.580.1
   (cherry picked from commit 7c2254f)

   Conflicts:

   changelog.html
   war/pom.xml
7. jenkins-infra-bot commented on Oct 19, 2014

   

   jenkins-infra-bot

   on Oct 19, 2014

   Author

   More actions

   scm_issue_link:

   • Original comment link
   • Raw content of original comment:

     Code changed in jenkins
     User: Kohsuke Kawaguchi
     Path:
      war/pom.xml
     http://jenkins-ci.org/commit/jenkins/1351b18e42b1677ee9bb14255583f5b3624d530a
     Log:
       JENKINS-25169 integrated the fix for POODLE
     
     
     

   Code changed in jenkins
   User: Kohsuke Kawaguchi
   Path:
   war/pom.xml
   http://jenkins-ci.org/commit/jenkins/1351b18e42b1677ee9bb14255583f5b3624d530a
   Log:
   JENKINS-25169 integrated the fix for POODLE
8. jenkins-infra-bot commented on Oct 20, 2014

   

   jenkins-infra-bot

   on Oct 20, 2014

   Author

   More actions

   scm_issue_link:

   • Original comment link
   • Raw content of original comment:

     Code changed in jenkins
     User: Kohsuke Kawaguchi
     Path:
      war/pom.xml
     http://jenkins-ci.org/commit/jenkins/2820dc723cc4029e529487ec62a71ce17afe1488
     Log:
       JENKINS-25169
     
     Integrating 2.8 to really ensure SSLv2 is off (even when JDK supports
     that, and we haven't found any JDKs that do that)
     
     
     

   Code changed in jenkins
   User: Kohsuke Kawaguchi
   Path:
   war/pom.xml
   http://jenkins-ci.org/commit/jenkins/2820dc723cc4029e529487ec62a71ce17afe1488
   Log:
   JENKINS-25169

   Integrating 2.8 to really ensure SSLv2 is off (even when JDK supports
   that, and we haven't found any JDKs that do that)
9. jenkins-infra-bot commented on Oct 20, 2014

   

   jenkins-infra-bot

   on Oct 20, 2014

   Author

   More actions

   dogfood:

   • Original comment link
   • Raw content of original comment:

     Integrated in  jenkins_main_trunk #3768
          [FIXED JENKINS-25169] (Revision 7c2254fbf8d643dc58673d01c97fd855f983d4bf)
     JENKINS-25169 (Revision 2820dc723cc4029e529487ec62a71ce17afe1488)
     
          Result = SUCCESS
     kohsuke : 7c2254fbf8d643dc58673d01c97fd855f983d4bf
     Files : 
     
     	
     war/pom.xml
     	
     changelog.html
     
     
     
     kohsuke : 2820dc723cc4029e529487ec62a71ce17afe1488
     Files : 
     
     	
     war/pom.xml
     
     
     

   Integrated in jenkins_main_trunk #3768
   [FIXED JENKINS-25169] (Revision 7c2254f)
   JENKINS-25169 (Revision 2820dc7)

   Result = SUCCESS
   kohsuke : 7c2254fbf8d643dc58673d01c97fd855f983d4bf
   Files :

   • war/pom.xml
   • changelog.html

   kohsuke : 2820dc723cc4029e529487ec62a71ce17afe1488
   Files :

   • war/pom.xml
10. jenkins-infra-bot commented on Oct 30, 2014

    

    jenkins-infra-bot

    on Oct 30, 2014

    Author

    More actions

    scm_issue_link:

    • Original comment link
    • Raw content of original comment:

      Code changed in jenkins
      User: Kohsuke Kawaguchi
      Path:
       war/pom.xml
      http://jenkins-ci.org/commit/jenkins/94590fdd69debdfe8469a074b3358f08f6ff0779
      Log:
        JENKINS-25169 integrated the fix for POODLE
      
      (cherry picked from commit 1351b18e42b1677ee9bb14255583f5b3624d530a)
      
      Conflicts:
      	war/pom.xml
      
      
      

    Code changed in jenkins
    User: Kohsuke Kawaguchi
    Path:
    war/pom.xml
    http://jenkins-ci.org/commit/jenkins/94590fdd69debdfe8469a074b3358f08f6ff0779
    Log:
    JENKINS-25169 integrated the fix for POODLE

    (cherry picked from commit 1351b18)

    Conflicts:
    war/pom.xml
11. jenkins-infra-bot commented on Oct 30, 2014

    

    jenkins-infra-bot

    on Oct 30, 2014

    Author

    More actions

    dogfood:

    • Original comment link
    • Raw content of original comment:

      Integrated in  jenkins_main_trunk #3787
           JENKINS-25169 integrated the fix for POODLE (Revision 94590fdd69debdfe8469a074b3358f08f6ff0779)
      
           Result = SUCCESS
      jesse glick : 94590fdd69debdfe8469a074b3358f08f6ff0779
      Files : 
      
      	
      war/pom.xml
      
      
      

    Integrated in jenkins_main_trunk #3787
    JENKINS-25169 integrated the fix for POODLE (Revision 94590fd)

    Result = SUCCESS
    jesse glick : 94590fdd69debdfe8469a074b3358f08f6ff0779
    Files :

    • war/pom.xml
12. jenkins-infra-bot commented on Oct 30, 2014

    

    jenkins-infra-bot

    on Oct 30, 2014

    Author

    More actions

    leo_:

    • Original comment link
    • Raw content of original comment:

      Since Jenkins ver. 1.586, the method to trigger builds remotely using TOKEN authentication URLs with wget described in https://wiki.jenkins-ci.org/display/JENKINS/Authenticating+scripted+clients no longer work due to SSLv1 and SSLv2 is now disabled because of the POODLE vulnerability fix.
      
      The following error will appear:
      
      Resolving jenkins... 10.0.0.1
      Connecting to jenkins|10.0.0.1|:443... connected.
      Unable to establish SSL connection.
      
      
      The command for wget 1.11.x needs to include the --secure-protocol=TLSv1 option.
      wget --auth-no-challenge --http-user=user --http-password=apiToken --secure-protocol=TLSv1 http://jenkins.yourcompany.com/job/your_job/build?token=TOKEN
      
      
      

    Since Jenkins ver. 1.586, the method to trigger builds remotely using TOKEN authentication URLs with wget described in https://wiki.jenkins-ci.org/display/JENKINS/Authenticating+scripted+clients no longer work due to SSLv1 and SSLv2 is now disabled because of the POODLE vulnerability fix.

    The following error will appear:

    Resolving jenkins... 10.0.0.1
    Connecting to jenkins|10.0.0.1|:443... connected.
    Unable to establish SSL connection.
    

    The command for wget 1.11.x needs to include the --secure-protocol=TLSv1 option.
    wget --auth-no-challenge --http-user=user --http-password=apiToken --secure-protocol=TLSv1 http://jenkins.yourcompany.com/job/your_job/build?token=TOKEN
    
    
13. jenkins-infra-bot commented on Oct 30, 2014

    

    jenkins-infra-bot

    on Oct 30, 2014

    Author

    More actions

    jglick:

    • Original comment link
    • Raw content of original comment:

      leo_ just add a note to the wiki.
      

    leo_ just add a note to the wiki.
14. jenkins-infra-bot commented on Oct 31, 2014

    

    jenkins-infra-bot

    on Oct 31, 2014

    Author

    More actions

    leo_:

    • Original comment link
    • Raw content of original comment:

      I've also edited and updated that wiki page so others can find the information easier.
      https://wiki.jenkins-ci.org/display/JENKINS/Authenticating+scripted+clients 
      

    I've also edited and updated that wiki page so others can find the information easier.
    https://wiki.jenkins-ci.org/display/JENKINS/Authenticating+scripted+clients
15. jenkins-infra-bot commented on Sep 24, 2015

    

    jenkins-infra-bot

    on Sep 24, 2015

    Author

    More actions

    dogfood:

    • Original comment link
    • Raw content of original comment:

      Integrated in  jenkins_main_trunk #4292
           JENKINS-25169 integrated the fix for POODLE (Revision 1351b18e42b1677ee9bb14255583f5b3624d530a)
      
           Result = UNSTABLE
      kohsuke : 1351b18e42b1677ee9bb14255583f5b3624d530a
      Files : 
      
      	
      war/pom.xml
      
      
      

    Integrated in jenkins_main_trunk #4292
    JENKINS-25169 integrated the fix for POODLE (Revision 1351b18)

    Result = UNSTABLE
    kohsuke : 1351b18e42b1677ee9bb14255583f5b3624d530a
    Files :

    • war/pom.xml
16. jenkins-infra-bot

    added

    bugFor changelog: Minor bug. Will be listed after featuresFor changelog: Minor bug. Will be listed after features

    security

    imported-jira-issue

    component:core

    priority:major

    resolution:fixed

    on Nov 24, 2025
17. jenkins-infra-bot commented on Nov 24, 2025

    

    jenkins-infra-bot

    on Nov 24, 2025

    Author

    More actions

    [Original relates_to from Jira: JENKINS-23925]
18. jenkins-infra-bot

    added the

    Bug

    issue type on Nov 25, 2025
19. jenkins-infra-bot

    removed

    bugFor changelog: Minor bug. Will be listed after featuresFor changelog: Minor bug. Will be listed after features

    on Nov 25, 2025