GitHub Advisoryadvisory · Maven

GHSA-w5r3-gr8w-7fj5 Jenkins Eggplant Runner Plugin protection mechanism disabled

MEDIUM Published 2025-10-29 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-64135
Ecosystem
Maven
Packages
io.jenkins.plugins:eggplant-runner
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-1188
Reviewed
2025-10-29

Affected packages

• Maven io.jenkins.plugins:eggplant-runner: <= 0.0.1.301.v963cffe8ddb (no fix yet)

Description

Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value as part of applying a proxy configuration. This disables a protection mechanism of the Java runtime addressing CVE-2016-5597. As of publication of this advisory, there is no fix.

Related

Alias · CVE (1)

  • CVE-2025-64135 Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes`… vulnerability

Weakness · CWE (1)

  • CWE-1188 Initialization of a Resource with an Insecure Default weakness

References