[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <ZDhnttxQd7ENy8C/@cc.hsalo.nerv.fi>
Date: Thu, 13 Apr 2023 23:36:27 +0300
From: Henri Salo <henri@...v.fi>
To: Demi Marie Obenour <demi@...isiblethingslab.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: Multiple vulnerabilities in Jenkins plugins
On Thu, Apr 13, 2023 at 01:36:14PM -0400, Demi Marie Obenour wrote:
> What is the reason for the large number of unfixed vulnerabilities?
> To me, this seems like an argument for not using Jenkins (or at least
> its plugins) at all.
> --
> Sincerely,
> Demi Marie Obenour (she/her/hers)
It's better for organizations to be aware of the vulnerabilities and risks
related to used software. Sometimes it is challenging to get the author/team to
fix the security issues (busy/unresponsive/miscommunication etc). This is very
common with plugins in different software as there are large number of
developers. It's better for users and community to disclose the issues if no
fix is provided as plugins can be disabled, WAF can be configured etc.
--
Henri Salo
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
