Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 13 Apr 2023 23:36:27 +0300
From: Henri Salo <>
To: Demi Marie Obenour <>
Subject: Re: Multiple vulnerabilities in Jenkins plugins

On Thu, Apr 13, 2023 at 01:36:14PM -0400, Demi Marie Obenour wrote:
> What is the reason for the large number of unfixed vulnerabilities?
> To me, this seems like an argument for not using Jenkins (or at least
> its plugins) at all.
> -- 
> Sincerely,
> Demi Marie Obenour (she/her/hers)

It's better for organizations to be aware of the vulnerabilities and risks
related to used software. Sometimes it is challenging to get the author/team to
fix the security issues (busy/unresponsive/miscommunication etc). This is very
common with plugins in different software as there are large number of
developers. It's better for users and community to disclose the issues if no
fix is provided as plugins can be disabled, WAF can be configured etc.

Henri Salo

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.