Hi,
Dating back many years, Jenkins has supported two network discovery
services (UDP multicast/broadcast and DNS multicast). When this was
first implemented this may have been a reasonable way to provide useful
lookup services. With modern Jenkins capabilities, networks, and
security considerations, this is no longer a good mechanism. There are
now other ways to better accomplish pretty much everything this does.
With Jenkins Security Advisory 2020-01-29 (
https://jenkins.io/security/advisory/2020-01-29/ ) these services were
disabled by default because
of<https://issues.jenkins-ci.org/browse/SECURITY-1641> SECURITY-1641 /
CVE-2020-2100.
The tests for these services have long been problematic because of
various system issues. They have never passed for me on my development
machine and others have reported the same. The issues are exacerbated
with Java 11.
We propose to remove these network discovery services. See
https://issues.jenkins-ci.org/browse/JENKINS-60913 and
https://github.com/jenkinsci/jenkins/pull/4460 .
Please respond with any agreement or if you have any important
implementations that require these capabilities. Perhaps if this is
still needed, the capabilities could be pulled out of core into a
plugin, maintained by someone that uses it.
Jeff Thompson
--
You received this message because you are subscribed to the Google Groups "Jenkins
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/jenkinsci-users/781cfc3a-3cf6-bfd1-c9ec-759d0db42ecb%40cloudbees.com.
