-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:eggplant-runner | maven | <= 0.0.1.301.v963cffe8ddb |
Miggo AIRoot Cause AnalysisThe vulnerability described in GHSA-w5r3-gr8w-7fj5 states that the Jenkins Eggplant Runner Plugin disables a Java security feature by setting the jdk.http.auth.tunneling.disabledSchemes system property to an empty string when configuring a proxy. By analyzing the source code of the plugin, I was able to locate the exact location where this occurs. The setProxy method within the io.jenkins.plugins.eggplant.utils.CLIRunnerHelper class is responsible for setting up the proxy configuration. Inside this method, the line System.setProperty("jdk.http.auth.tunneling.disabledSchemes", ""); is present, which directly corresponds to the described vulnerability. This method is invoked when the plugin attempts to download the Eggplant runner CLI via a proxy. The build process is initiated by the perform method in the io.jenkins.plugins.eggplant.EggplantRunnerBuilder class, which would be the top-level function in a stack trace when the vulnerability is triggered.
A Semantic Attack on Google Gemini - Read the Latest Research