[JIRA] (JENKINS-59552) Detached plugins installed are those with security warnings

[awiddersh...@hotmail.com (JIRA)]

Title: Message Title

Andrew Widdersheim created an issue   Jenkins / JENKINS-59552 Detached plugins installed are those with security warnings Issue Type: Bug Assignee: Carlos Sanchez Components: docker Created: 2019-09-26 15:27 Priority: Critical Reporter: Andrew Widdersheim When running Jenkins with the official Docker container, some plugins will pull in detached plugins that have security vulnerabilities and also have newer versions available that could be used instead. To replicate, you can install https://plugins.jenkins.io/purge-build-queue-plugin# for example. This will pull in a vulnerable version of https://plugins.jenkins.io/pam-auth: jenkins_1 | INFO: Loading a detached plugin as a dependency: /var/jenkins_home/plugins/pam-auth.jpi jenkins_1 | WARNING: Created /var/jenkins_home/plugins/pam-auth/WEB-INF/lib/classes.jar; update plugin to a version created with a newer harness jenkins_1 | INFO: Took 0ms for Loading plugin PAM Authentication plugin v1.1 (pam-auth) by pool-6-thread-4 jenkins_1 | INFO: Took 0ms for Initializing plugin pam-auth by pool-6-thread-1 According to Jesse Glick, this is a bug and not intended behavior.  This might be scoped to just running with Docker but it's the only place I'm able to test and replicate. Add Comment   This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.202183.1569511656000.6145.1569511680312%40Atlassian.JIRA.