| Package | Affected versions | Patched versions |
|---|---|---|
| io.jenkins.plugins:eggplant-runner | ≤ 0.0.1.301.v963cffe8ddb | |
| eggplant runner | ≤ 0.0.1.301.v963cffe8ddb_8 |
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value as part of applying a proxy configuration.
This disables a protection mechanism of the Java runtime addressing CVE-2016-5597.
As of publication of this advisory, there is no fix.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free