CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

devel/jenkins-lts2.580.1

Open-source continuous integration server

Maintainer
lwhsu@FreeBSD.org
Packages
jenkins-lts 2.580.1
Upstream
up to date
CPE
jenkins:jenkins from the port
WWW
https://jenkins.io/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (68)

VuXML entries whose affected range this version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVE-2026-846458.8published 2026-09-02

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field values in user-submitted `config.xml` documents and subsequently handle HTTP requests via Stapler, resulting in remote cod…

CVE-2026-846488.8published 2026-09-02

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

CVE-2026-846508.8published 2026-09-02

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

CVE-2026-846527.3published 2026-09-02

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacke…

CVE-2026-846516.3published 2026-09-02

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure permission on one agent to take over a different agent, gaini…

CVE-2026-846464.3published 2026-09-02

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.

Commits (167)

Li-Wen Hsu (lwhsu) · 2.580.1
devel/jenkins-lts: Update to 2.580.1

Sponsored by:	The FreeBSD Foundation
7de9a4704b
Li-Wen Hsu (lwhsu) · 2.568.3
devel/jenkins-lts: Update to 2.568.3

Security:	102bc631-a6da-11f1-ba21-00e0edd85c6a
MFH:		2026Q3
Sponsored by:	The FreeBSD Foundation
e430b4b59a
Li-Wen Hsu (lwhsu) · 2.568.2_1
devel/jenkins{,-lts}: Fix rc script output handling

- Add -f to daemon(8) so the service does not keep the caller's
  terminal or pipe open.  Before this, `service jenkins restart | tail`
  hung forever.
- Let rc.subr handle the user switch instead of a custom start_cmd.

Sponsored by:	The FreeBSD Foundation
d9d158c219
Li-Wen Hsu (lwhsu) · 2.568.2
devel/jenkins-lts: Update to 2.568.2

Security:	9096f6e4-3a2f-4d16-89fb-f909aa0a7760
MFC:		2026Q3
Sponsored by:	The FreeBSD Foundation
5a19d0469f
Li-Wen Hsu (lwhsu) · 2.568.1
devel/jenkins-lts: Update to 2.568.1

Sponsored by:	The FreeBSD Foundation
e12c8e21fe
Li-Wen Hsu (lwhsu) · 2.555.3
devel/jenkins-lts: Update to 2.555.3

MFH:		2026Q2
Security:	35598415-56de-4562-959c-11fb1fd2d995
Sponsored by:	The FreeBSD Foundation
7c7aef17f3
Li-Wen Hsu (lwhsu) · 2.555.2
devel/jenkins-lts: Update to 2.555.2

Sponsored by:	The FreeBSD Foundation
7561a88b00
Li-Wen Hsu (lwhsu) · 2.555.1
devel/jenkins-lts: Update to 2.555.1

Sponsored by:	The FreeBSD Foundation
3614ff257c
Ronald Klop (ronald) · 2.541.3_1
*/*: bump portrevision after java_default=25 update

Included all ports that have USES=java.

PR:	293559
86813e9ccf
Li-Wen Hsu (lwhsu) · 2.541.3
devel/jenkins-lts: Update to 2.541.3

Security fix for CVE-2026-33001 and CVE-2026-33002.

Security:	970fd0ec-26f5-11f1-a9b1-0cc47ada5f32
MFC:		2026Q1
Sponsored by:	The FreeBSD Foundation
c92326ef5d
Ronald Klop (ronald) · 2.541.2_1
*/*: bump portrevision after java_default=21 update

PR:	272855
2baaf16375
Li-Wen Hsu (lwhsu) · 2.541.2
devel/jenkins-lts: Update to 2.541.2

Security:	428e782a-0e92-11f1-a9b1-0cc47ada5f32
MFC:		2026Q1
Sponsored by:	The FreeBSD Foundation
4b74069478
Li-Wen Hsu (lwhsu) · 2.541.1
devel/jenkins-lts: Update to 2.541.1

Sponsored by:	The FreeBSD Foundation
ecc7981924
Li-Wen Hsu (lwhsu) · 2.528.3
devel/jenkins-lts: Update to 2.528.3

Fixes CVE-2025-67635, CVE-2025-67636, CVE-2025-67637, CVE-2025-67638,
CVE-2025-67639

PR:		291580
Security:	2956aba3-1fcb-4c39-9cea-d88a46a3bf93
MFH:		2025Q4
Sponsored by:	The FreeBSD Foundation
2823eb8ac2
Li-Wen Hsu (lwhsu) · 2.528.2
devel/jenkins-lts: Update to 2.528.2

Sponsored by:	The FreeBSD Foundation
633e338f78
Li-Wen Hsu (lwhsu) · 2.528.1
devel/jenkins-lts: Update to 2.528.1

Sponsored by:	The FreeBSD Foundation
84e02f358a
Li-Wen Hsu (lwhsu) · 2.516.3
devel/jenkins-lts: Update to 2.516.3

MFH:		2025Q3
Security:	b9b668f0-96ec-4568-b618-2edea45d6933
Sponsored by:	The FreeBSD Foundation
4b66112e57
Li-Wen Hsu (lwhsu) · 2.516.2
devel/jenkins-lts: Update to 2.516.2

Sponsored by:	The FreeBSD Foundation
a21dd879f3
Li-Wen Hsu (lwhsu) · 2.516.1
devel/jenkins-lts: Update to 2.516.1

Sponsored by:	The FreeBSD Foundation
6811f37159
Ronald Klop (ronald) · 2.504.3
devel/jenkins-lts: update to 2.504.3 and use jdk21

Starting with Jenkins LTS 2.504.2 upstream uses JDK21 in published images.
Let's follow upstream and run on a modern JDK.
All FreeBSD architectures that have JDK17 also have JDK21.
NB: Jobs in Jenkins can/should use their own compiler version.

See also: https://www.jenkins.io/doc/book/platform-information/upgrade-java-to-21/index.html

PR:	287112
Approved by:	lwhsu@ (maintainer)
b601a610c5
Li-Wen Hsu (lwhsu) · 2.504.2
devel/jenkins-lts: Update to 2.504.2

Sponsored by:	The FreeBSD Foundation
61941f8850
Ronald Klop (ronald) · 2.504.1
devel/jenkins-lts: Update to 2.504.1

Changes:
https://www.jenkins.io/changelog-stable/#v2.504.1

PR:	286623
Approved by:	lwhsu (maintainer)
9717500496
Li-Wen Hsu (lwhsu) · 2.492.3
devel/jenkins-lts: Update to 2.492.3

MFH:		2025Q2
Security:	45276ea6-1653-4240-9986-ccfc6fec7ece
Sponsored by:	The FreeBSD Foundation
a0880a58da
Li-Wen Hsu (lwhsu) · 2.492.2
devel/jenkins-lts: Update to 2.492.2

Security:	cb98d018-f9f5-11ef-a398-00e081b7aa2d
Sponsored by:	The FreeBSD Foundation
604b9a8294
Li-Wen Hsu (lwhsu) · 2.492.1
devel/jenkins-lts: Update to 2.492.1

Sponsored by:	The FreeBSD Foundation
7c103a95aa
Li-Wen Hsu (lwhsu) · 2.479.3
devel/jenkins-lts: Update to 2.479.3

Sponsored by:	The FreeBSD Foundation
ef2515a752
Muhammad Moinur Rahman (bofh) · 2.479.2
Mk/**java.mk: Convert bsd.java.mk to USES

The following features have been added or changed:
- Instead of USE_JAVA use USES=java. This defaults to
  USES=java:build,run if NO_BUILD is undefined. Else it defaults to
  USES=java:run
- Instead of USE_ANT=yes use USES=java:ant which also implies
  USES=java:build
- Instead of JAVA_BUILD=yes use USES=java:build. Does not imply run or
  extract
- Instead of JAVA_EXTRACT=yes use USES=java:extract does not imply
  build or run
- Instead of JAVA_RUN=yes use USES=java:run does not imply extract or
  build
- Instead of USE_JAVA=<version> use USES=java and JAVA_VERSION=<version>

Approved by: mat (portmgr), glewis
Differential Revision:  https://reviews.freebsd.org/D48201
0835676e36
Li-Wen Hsu (lwhsu) · 2.479.2
devel/jenkins-lts: Update to 2.479.2

Security:	c5dafd73-adfd-11ef-af27-00e081b7aa2d
Sponsored by:	The FreeBSD Foundation
9af0de8caf
Li-Wen Hsu (lwhsu) · 2.479.1_1
devel/jenkins-lts: Update the Java version requirement to 17+

As described in
https://www.jenkins.io/doc/book/platform-information/support-policy-java/

PR:		282572
Reported by:	Urs <urs.probst@triamec.com>
187cccbda7
Li-Wen Hsu (lwhsu) · 2.479.1
devel/jenkins-lts: Update to 2.479.1

Sponsored by:	The FreeBSD Foundation
0a9707060c
Li-Wen Hsu (lwhsu) · 2.462.3
devel/jenkins-lts: Update to 2.462.3

Security:	3c6f8270-3210-4e2f-ba72-a9cdca7417a0
Sponsored by:	The FreeBSD Foundation
77c26566c8
Li-Wen Hsu (lwhsu) · 2.462.1
devel/jenkins-lts: Update to 2.462.1

Sponsored by:	The FreeBSD Foundation
54f967b9b3
Li-Wen Hsu (lwhsu) · 2.452.4
devel/jenkins-lts: 2.452.4

Security:	db8fa362-0ccb-4aa8-9220-72b7763e9a4a
Sponsored by:	The FreeBSD Foundation
67cb31aa2d
Li-Wen Hsu (lwhsu) · 2.452.3
devel/jenkins-lts: Update to 2.452.3

Sponsored by:	The FreeBSD Foundation
a602a4abc5
Li-Wen Hsu (lwhsu) · 2.452.2
devel/jenkins-lts: Update to 2.452.2

Sponsored by:	The FreeBSD Foundation
cdd3e7b5c8
Li-Wen Hsu (lwhsu) · 2.452.1
devel/jenkins-lts: Update to 2.452.1

Sponsored by:	The FreeBSD Foundation
70fa159105
Li-Wen Hsu (lwhsu) · 2.440.3
devel/jenkins-lts: Update to 2.440.3

Security:	4ebdd56b-fe72-11ee-bc57-00e081b7aa2d
Sponsored by:	The FreeBSD Foundation
e7aed746b6
Li-Wen Hsu (lwhsu) · 2.440.2
devel/jenkins-lts: Update to 2.440.2

Security:	2e3bea0c-f110-11ee-bc57-00e081b7aa2d
Sponsored by:	The FreeBSD Foundation
573c04529f
Li-Wen Hsu (lwhsu) · 2.440.1
devel/jenkins-lts: Update to 2.440.1

Sponsored by:	The FreeBSD Foundation
927f575d84
Li-Wen Hsu (lwhsu) · 2.426.3
devel/jenkins-lts: Update to 2.426.3

MFH:		2024Q1
Security:	8b03d274-56ca-489e-821a-cf32f07643f0
Sponsored by:	The FreeBSD Foundation
cfbd6540ab
Li-Wen Hsu (lwhsu) · 2.426.2
devel/jenkins-lts: Update to 2.426.2

Sponsored by:	The FreeBSD Foundation
67bbaca573
Li-Wen Hsu (lwhsu) · 2.426.1
devel/jenkins-lts: Update to 2.426.1

Sponsored by:	The FreeBSD Foundation
f5ca8bf86b
Li-Wen Hsu (lwhsu) · 2.414.3
devel/jenkins-lts: Update to 2.414.3

Security:	d2ad7647-6dd9-11ee-85eb-84a93843eb75
Sponsored by:	The FreeBSD Foundation
edf6d0db13
Li-Wen Hsu (lwhsu) · 2.414.2
devel/jenkins-lts: Update to 2.414.2

MFH:		2023Q3
Security:	402fccd0-5b6d-11ee-9898-00e081b7aa2d
Sponsored by:	The FreeBSD Foundation
e8074a025d
Li-Wen Hsu (lwhsu) · 2.414.1
devel/jenkins-lts: Update to 2.414.1

Sponsored by:	The FreeBSD Foundation
cfd5535042
Li-Wen Hsu (lwhsu) · 2.401.3
devel/jenkins-lts: Update to 2.401.3

Security:	a0321b74-031d-485c-bb76-edd75256a6f0
Sponsored by:	The FreeBSD Foundation
4fae358656
Li-Wen Hsu (lwhsu) · 2.401.2
devel/jenkins-lts: Update to 2.401.2

Sponsored by:	The FreeBSD Foundation
080b37e675
Li-Wen Hsu (lwhsu) · 2.401.1
devel/jenkins-lts: Update to 2.401.1

Sponsored by:	The FreeBSD Foundation
b744f8ac9c
Li-Wen Hsu (lwhsu) · 2.387.3
devel/jenkins-lts: Update to 2.387.3

Sponsored by:	The FreeBSD Foundation
1f81792a44
Li-Wen Hsu (lwhsu) · 2.387.2
devel/jenkins-lts: Update to 2.387.2

Sponsored by:	The FreeBSD Foundation
46556f8c94