jenkinsci / jenkinsci/plugin-installation-manager-tool

Plugin Installation Manager 2.15.0 bundles jackson-databind 2.20.1

Open
#918 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
463
Forks
228
Avg merge
31m
Merged PRs (30d)
15

Description

While scanning the latest Jenkins Plugin Installation Manager (v2.15.0) using Trivy, we observed that the bundled jackson-databind dependency is version 2.20.1, which is reported with multiple vulnerabilities.

Plugin Installation Manager version:
$ java -jar jenkins-plugin-manager.jar --version
2.15.0
The embedded dependency can be verified with:
unzip -p jenkins-plugin-manager.jar \
META-INF/maven/com.fasterxml.jackson.core/jackson-databind/pom.properties
Output:
artifactId=jackson-databind
groupId=com.fasterxml.jackson.core
version=2.20.1
Trivy reports the following package:

PkgPath: usr/share/jenkins/jenkins-plugin-manager.jar
Package: com.fasterxml.jackson.core:jackson-databind
Installed Version: 2.20.1

Could you please let us know if there are plans to update the bundled Jackson dependency and publish a new Plugin Installation Manager release?

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the reported version with `java -jar jenkins-plugin-manager.jar --version` and inspect the embedded dependency at `META-INF/maven/com.fasterxml.jackson.core/jackson-databind/pom.properties`. Determine where the bundled Jackson version is declared, update it to a non-vulnerable version, and verify that a new Plugin Installation Manager artifact reports the expected dependency version.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.