In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field values in user-submitted `config.xml` documents and subsequently handle HTTP requests via Stapler, resulting in remote cod…
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacke…
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure permission on one agent to take over a different agent, gaini…
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.
devel/jenkins{,-lts}: Fix rc script output handling
- Add -f to daemon(8) so the service does not keep the caller's
terminal or pipe open. Before this, `service jenkins restart | tail`
hung forever.
- Let rc.subr handle the user switch instead of a custom start_cmd.
Sponsored by: The FreeBSD Foundation
devel/jenkins-lts: Update to 2.541.3
Security fix for CVE-2026-33001 and CVE-2026-33002.
Security: 970fd0ec-26f5-11f1-a9b1-0cc47ada5f32
MFC: 2026Q1
Sponsored by: The FreeBSD Foundation
devel/jenkins-lts: update to 2.504.3 and use jdk21
Starting with Jenkins LTS 2.504.2 upstream uses JDK21 in published images.
Let's follow upstream and run on a modern JDK.
All FreeBSD architectures that have JDK17 also have JDK21.
NB: Jobs in Jenkins can/should use their own compiler version.
See also: https://www.jenkins.io/doc/book/platform-information/upgrade-java-to-21/index.html
PR: 287112
Approved by: lwhsu@ (maintainer)
Mk/**java.mk: Convert bsd.java.mk to USES
The following features have been added or changed:
- Instead of USE_JAVA use USES=java. This defaults to
USES=java:build,run if NO_BUILD is undefined. Else it defaults to
USES=java:run
- Instead of USE_ANT=yes use USES=java:ant which also implies
USES=java:build
- Instead of JAVA_BUILD=yes use USES=java:build. Does not imply run or
extract
- Instead of JAVA_EXTRACT=yes use USES=java:extract does not imply
build or run
- Instead of JAVA_RUN=yes use USES=java:run does not imply extract or
build
- Instead of USE_JAVA=<version> use USES=java and JAVA_VERSION=<version>
Approved by: mat (portmgr), glewis
Differential Revision: https://reviews.freebsd.org/D48201
devel/jenkins-lts: Update the Java version requirement to 17+
As described in
https://www.jenkins.io/doc/book/platform-information/support-policy-java/
PR: 282572
Reported by: Urs <urs.probst@triamec.com>