Skip to content
This repository has been archived by the owner on Nov 21, 2017. It is now read-only.

Noting impact of JENKINS-41745 #8

Merged
merged 1 commit into from
Apr 9, 2017
Merged

Noting impact of JENKINS-41745 #8

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,14 @@
**This mitigation is obsolete as of Jenkins 2.54.**
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Assuming the merge lands in 2.54 weekly, obviously.

If you have installed a 2.54+ version of Jenkins anew, the Remoting-based CLI is disabled out of the box.
If you installed an older version of Jenkins and upgraded to 2.54+,
you will be prompted by an administrative monitor
to go to **Configure Global Security** and disable the Remoting-based CLI.
In either case, the following workarounds are unnecessary.

Or, if you are using Jenkins 2.32+ or 2.19.3+
(as mentioned in the [security advisory of 2016 Nov 16](https://jenkins.io/security/advisory/2016-11-16/)),
but older than 2.54, you may simply use the startup switch: `-Djenkins.CLI.disabled=true`

# Mitigation for unauthenticated remote code execution via CLI

> NOTE: This script was originally published in **November 2015** to fix the **SECURITY-218** zero-day vulnerability. It can also be applied as a workaround for the **SECURITY-360** zero-day vulnerability published in **November 2016**.
Expand Down