jenkinsci / jenkinsci/plugin-installation-manager-tool
Plugin Installation Manager 2.15.0 bundles jackson-databind 2.20.1
- Dominant language
- Java
- Stars
- 463
- Forks
- 228
- Avg merge
- 31m
- Merged PRs (30d)
- 15
Description
While scanning the latest Jenkins Plugin Installation Manager (v2.15.0) using Trivy, we observed that the bundled jackson-databind dependency is version 2.20.1, which is reported with multiple vulnerabilities.
Plugin Installation Manager version:
$ java -jar jenkins-plugin-manager.jar --version
2.15.0
The embedded dependency can be verified with:
unzip -p jenkins-plugin-manager.jar \
META-INF/maven/com.fasterxml.jackson.core/jackson-databind/pom.properties
Output:
artifactId=jackson-databind
groupId=com.fasterxml.jackson.core
version=2.20.1
Trivy reports the following package:
PkgPath: usr/share/jenkins/jenkins-plugin-manager.jar
Package: com.fasterxml.jackson.core:jackson-databind
Installed Version: 2.20.1
Could you please let us know if there are plans to update the bundled Jackson dependency and publish a new Plugin Installation Manager release?
Contributor guide
Research direction
Start by reproducing the reported version with `java -jar jenkins-plugin-manager.jar --version` and inspect the embedded dependency at `META-INF/maven/com.fasterxml.jackson.core/jackson-databind/pom.properties`. Determine where the bundled Jackson version is declared, update it to a non-vulnerable version, and verify that a new Plugin Installation Manager artifact reports the expected dependency version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100