The Jenkins security team has been made aware of a new attack vector for a remote code execution vulnerability in the Jenkins CLI, according to this advisory by Daniel Beck: We have received a report of a possible unauthenticated remote code execution vulnerability in Jenkins (all versions). We strongly advise anyone running a Jenkins instance on a public network disable the CLI for now. As this uses the same attack vector as SECURITY-218, you can reuse the...

We created new native packages for Jenkins 2.7.1 today. These replace the existing packages. Due to a release process issue, the packaging (RPM, etc.) was created the same way as Jenkins 1.x LTS, resulting in problems starting Jenkins on some platforms: While we dropped support for AJP in Jenkins 2.0, some 1.x packages had it enabled by default, resulting in an exception during startup. These...

It’s been almost three months since we’ve released Jenkins 2.0, the first ever major version upgrade for this 10 year old project. The 2.x versions since then has been adopted by more than 20% of the users, but one segment of users who haven’t seen the benefits of Jenkins 2 is those who has been running LTS releases. But that is no more! The new...

(This is a guest post from Michael Neale) Recently at the Docker Conference (DockerCon) the Docker Hub was announced. The hub (which includes their image building and storage service) also provides some "official" images (sometimes they call them repositories - they are really just sets of images). So after talking with all sorts of people we decided to create an official Jenkins image - which is hosted...

Over the past 30 days or so, the acceptance test project has made a great progress. This project consists of a reusable harness that can be used by plugin developers and users to write functional test cases. These tests can be run against Jenkins instances that are deployed in all sorts of different ways, and can interact with complex real fixtures. These tests can be...

The final LTS release of the 1.532.x line is out today. You can download it from the usual location. Changelog is here. Starting with the next 1.554.x LTS, the release model will switch to the train model, where we commit to dates and get whatever we can ship by that date. You can see the scheduled dates in our event calendar. Backporting window for 1.554.1 is...

We just posted the updated Long-term Release (LTS) of 1.409.2. Just as a recap, with LTS releases, we plan on providing a release train that only has backported changes. 1.409.2 contains a handful of important bug fixes since 1.409.1. For more about LTS, see this wiki page. Thanks to the heroic effort of those who are involved, namely Vojtech Juranek and a bunch of heroes, this...

A couple of months ago Jenkins embarked on an new project, the Jenkins "LTS" (Long Term Support) release line. A LTS branch of development is common in most major open source projects, especially those with substantial corporate adoption, so this was a great step for the project as a whole. We’re now coming up on the second LTS release, which will be an incremental update to the previous one (1.409.1)...

We have released 1.409.1, our first long-term support (LTS) release, from the Jenkins project. The idea of the LTS release is to provide a second release line the favors more stability and bug fix only maintenance. This release line branches off from a bit old Jenkins release (in this case 1.409), and we will only put important backported bug fixes. We’ll keep releasing 1.409.2, 1.409.3,...