Showing posts with label jenkins. Show all posts
Showing posts with label jenkins. Show all posts

Wednesday, January 9, 2019

Jenkins security release: Script Security sandbox bypass

The Jenkins security team has published a Jenkins Security Advisory announcing a new vulnerability in some Jenkins plugins. This vulnerability bypasses the Jenkins sandbox protection in the Script Security Plugin and Pipeline Plugins, which allows an attacker to execute arbitrary code on the Jenkins primary node.



It is strongly recommended that you update your Jenkins’ plugins to their latest versions. You can follow our documentation to learn how to upgrade them. Below is the list of affected plugins and the versions you should upgrade to:


  • Pipeline: Declarative Plugin should be updated to version 1.3.4.1
  • Pipeline: Groovy Plugin should be updated to version 2.61.1
  • Script Security Plugin should be updated to version 1.50

You can find more information about the Jenkins security announcement in the Jenkins Security Advisory.

We believe it is of the utmost importance to quickly address any security issues in applications distributed by Bitnami. Our team has already updated our different solutions with the new versions of each plugin and we are working on updating the different marketplaces as soon as possible.

If you have further questions about Bitnami Jenkins or this security issue, please post to our community forum and we will be happy to help you.

Wednesday, December 5, 2018

Security Alert: Jenkins Code Execution through Crafted URLs

The Jenkins project released a new version that fixes multiple security vulnerabilities. The most important one is the “Code execution through crafted URLs”. This vulnerability allows invoking methods that were never intended to be invoked in this way.

We recommend that you update your Jenkins installations to the latest version. Please follow our documentation to learn how to upgrade your application. If you are using the Bitnami Jenkins Docker container image, please follow the documentation in our GitHub repository.

You can find more information about this Jenkins security issue in the Jenkins Security Advisory.

Bitnami has released Jenkins version v2.150.1, in containers, Helm Charts, Multi-Tier solutions, installers, virtual machines, and cloud images to fix these vulnerabilities.

The Bitnami Jenkins stack offered in bitnami.com and in our cloud-specific launchpads has been updated to that new version. New launches of Bitnami Jenkins via our launchpads are secure and do not need to be updated further.

Users who launch Bitnami Jenkins via cloud marketplaces are advised to select the version v2.150.1 of Bitnami Jenkins, once it is published. Installations based on previous versions must be upgraded using the process described above.

If you have further questions or concerns about Bitnami Jenkins or about this security issue, please post to our community forum and we will be happy to help you.

Thursday, July 19, 2018

Security Release: Jenkins 2.121.2

The Jenkins project released a new version that fixes multiple security vulnerabilities. These vulnerabilities allow unauthenticated users to reset parts of the Jenkins configuration as well as to read arbitrary files inside the installation, cancel builds, or abort agent launches.

We recommend that you update your Jenkins installations to the latest version. You can follow our documentation to learn how to upgrade your application. If you are using the Bitnami Jenkins Docker container image, please follow the documentation in our GitHub repository.

You can find more information about this Jenkins security issue in the Jenkins Security Advisory.

Bitnami has released Jenkins 2.121.2 containers, Helm Charts, Multi-Tier solutions, installers, virtual machines and cloud images that address these vulnerabilities.

https://bitnami.com/stack/jenkins

The Bitnami Jenkins stack offered in bitnami.com/stacks and in our cloud-specific launchpads has been updated to that new version. New launches of Bitnami Jenkins via our launchpad are secure and do not need to be updated further.

Users launching Bitnami Jenkins via a cloud marketplace are advised to select version 2.121.2 of Bitnami Jenkins, once it is published. Installations based on previous versions will need to be upgraded as described above.

If you have further questions about Bitnami Jenkins or this security issue, please post to our community forum and we will be happy to help you.

Monday, March 5, 2018

Bitnami Jenkins - Oracle Jump Start Demo Lab

While Bitnami has always made it easy to launch cloud applications, Oracle has taken it one step further with their Jump Start Demo Lab program. Now not only do you get free access to ready-to-run Bitnami applications, but you also get free access to the Oracle cloud to test the application as well.

Bitnami has been collaborating with the Oracle Jump Start team on several popular applications and we’re announcing today the availability of our Jenkins Demo Lab.

Bitnami Jenkins

If your job involves developing or deploying software, you've probably already heard of Jenkins, a Continuous Integration (CI) server designed specifically for automating software builds and deployments. As a leading open source project, Jenkins is extremely versatile and comes with 1000+ plugins that allow easy integration with many different platforms, source code management systems and build systems. Jump Start allows you to try a Jenkins on OCI in a self-paced guided demo environment for free.

Ready to get started?

If you are ready to automate your software testing and delivery process and would like to explore the functionality of Jenkins for free in one of the world’s leading clouds, then this is your chance.

Visit Oracle Jump Start page for detailed instructions to get you up and running right away.

How to Guides:

Want more? Curious about other Oracle Jump Start applications?

See the entire Bitnami application catalog available in the Oracle Cloud
https://oracle.bitnami.com/

Tuesday, August 8, 2017

Security Release: Jenkins Plugins Vulnerabilities

The Jenkins project has published a security advisory due to some plugins vulnerabilities. These are the affected plugins:
  • Blue Ocean:
    • GitHub Pipeline for Blue Ocean up to and including 1.1.5, 1.2.0 beta releases up to and including 1.2.0-beta-3
    • REST Implementation for Blue Ocean up to and including 1.1.5, 1.2.0 beta releases and up to and including 1.2.0-beta-3
    • Bitbucket Pipeline for Blue Ocean 1.2.0-beta-3
  • Config File Provider Plugin up to and including 2.16.1
  • Datadog Plugin up to and including 0.5.6
  • Deploy to container Plugin up to and including 1.12
  • DRY Plugin up to and including 2.48
  • OWASP Dependency-Check Plugin up to and including 2.0.1.1
  • Pipeline: Groovy Plugin up to and including 2.38
  • Pipeline: Input Step Plugin up to and including 2.7
  • Script Security Plugin up to and including 1.30
  • Static Analysis Utilities Plugin up to and including 1.91
Bitnami deployments include some of these plugins by default. It is strongly recommended that you update your Jenkins plugins to the latest version, Jenkins 2.60.2-1. You can upgrade the plugins of your Bitnami Jenkins application following our documentation.

For new application deployments, Bitnami has released Jenkins 2.60.2-1 LTS installers, virtual machines and cloud images with the latest versions of the plugins that include the security fixes. If you deploy Bitnami Jenkins via one of our cloud partner marketplaces and it is not yet updated to 2.60.2-1, we strongly suggest that you update your Jenkins plugins to this latest version. If you are using the Bitnami Jenkins Docker container image, please follow the documentation in our GitHub repository to upgrade your deployment to the 2.73 Jenkins version with the latest plugins.

If you have further questions about Bitnami Jenkins or this security issue, please post to our community forums and we will be happy to help you.

Thursday, July 13, 2017

Security Release: Jenkins plugins vulnerabilities

The Jenkins project has published a security advisory due to some plugins vulnerabilities. These are the affected plugins:
  • Docker Commons Plugin up to and including version 1.7
  • Git Plugin up to and including version 3.3.1 and 2.4.0-beta-1
  • GitHub Branch Source Plugin up to and including version 2.0.7 and 2.2.0-beta-1
  • Parameterized Trigger Plugin up to and including version 2.34
  • Periodic Backup Plugin up to and including version 1.4
  • Pipeline: Build Step Plugin up to and including version 2.5
  • Pipeline: Groovy Plugin up to and including version 2.36
  • Poll SCM Plugin up to and including version 1.3
  • Role-based Authorization Strategy Plugin up to and including version 2.5.0
  • Script Security Plugin up to and including version 1.29
  • Sidebar Link Plugin up to and including version 1.8
  • SSH Plugin up to and including version 2.4
  • Subversion Plugin up to and including version 2.8
Bitnami deployments include some of these plugins by default. It is strongly recommended that you update your Jenkins plugins to the latest version. You can upgrade the plugins of your Bitnami Jenkins following our documentation.

For new application deployments, Bitnami has released Jenkins 2.60.1 LTS installers, virtual machines and cloud images with the latest versions of the plugins that include the security fixes. If you deploy Bitnami Jenkins via one of our cloud partner marketplaces and it is not yet updated to 2.60.1, we strongly sugges that you update your Jenkins plugins to the latest version. If you are using the Bitnami Jenkins Docker container image, please follow the documentation in our GitHub repository to upgrade your deployment to the 2.69 Jenkins version with the latest plugins.

If you have further questions about Bitnami Jenkins or this security issue, please post to our community forums and we will be happy to help you.

Friday, April 28, 2017

Security Release: Jenkins 2.57/2.46.2

The Jenkins project has released a new version that fixes multiple Cross-Site Request Forgery vulnerabilities, along with an unauthenticated remote code execution vulnerability & an impersonation issue.

It is strongly suggested that you update your Jenkins installations to the latest version. You can follow our documentation to learn how to upgrade your application. If you are using the Bitnami Jenkins Docker container image, please follow the documentation in our GitHub repository.

You can find more information about the Jenkins security issues in the Jenkins Security Advisory.



Bitnami has released Jenkins 2.57 containers, and Jenkins 2.46.2 installers, virtual machines and cloud images that address these vulnerabilities.

https://bitnami.com/stack/jenkins

The Bitnami Jenkins offered on Bitnami.com and on our cloud-specific launchpads has been updated to version 2.46.2. New launches of Bitnami Jenkins via our launchpad are secure and do not need to be further updated.

Users launching Bitnami Jenkins via a cloud marketplace are advised to select version 2.46.2 of Bitnami Jenkins, once it is published. Installations based on previous versions will need to be upgraded as described above.

If you have further questions about Bitnami Jenkins or this security issue, please post to our community forum and, we will be happy to help you.

Thursday, February 2, 2017

Security Release: Jenkins 2.44/2.32.2

[UPDATE 2017-02-03]

For new application deployments, Bitnami has released Jenkins 2.44 containers, and Jenkins 2.32.2 installers, virtual machines and cloud images that address these vulnerabilities. If you deploy Bitnami Jenkins via a Bitnami Launchpad, your application will be up-to-date and secure. If you deploy Bitnami Jenkins via one of our cloud partner marketplaces and it is not yet updated to version 2.32.2, you will need to upgrade your application using the documentation linked below.

----

The Jenkins project has just released a new version that fixes multiple security issues, including a fix for a XStream remote code execution vulnerability.

It is strongly suggested that you update your Jenkins application to the latest version. You can follow our documentation to learn how to upgrade your application. If you are using the Bitnami Jenkins container, please follow the documentation in our GitHub repository.


You can find more information about the Jenkins security issues in the Jenkins Security Advisory.



We believe it is of the utmost importance to quickly address any security issues in applications distributed by Bitnami. Our team is working to update all of the affected Jenkins packages available through Bitnami as quickly as possible.

If you have further questions about Bitnami Jenkins or this security issue, please post to our community forum,and we will be happy to help you.

Tuesday, November 24, 2015

Bitnami Jenkins now with Docker

We are happy to announce that we now ship Docker pre-installed 
in all Bitnami Jenkins Virtual Machines and Cloud Images.

What does it mean?

It means that now you will be able to dynamically provision Docker containers as Jenkins on-demand replicas to do your jobs in an isolated environment. The advantage is that you can run each job in a separate and controlled environment, without interfering with other jobs. It also has the ability to automatically destroy those containers when the job finishes.

Do you need Java to test your Java application? Create a replica for your job and install Java without worrying about affecting your CI environment.

How can I configure Jenkins to dynamically provision container replicas?

You can find a step-by-step guide in the following page of the Bitnami wiki:
https://wiki.bitnami.com/Applications/Bitnami_Jenkins/Configure_Jenkins_container_slaves

Basically, the steps are the following (please note these steps are an overview):

  • Step 1: Build a container image with SSH access and specific credentials (more detailed instructions can be found in the previous mentioned wiki page).
  • Step 2: Configure the Docker Jenkins plugin already bundled.
    • Step 2.1: Enter your "Manage Jenkins" panel and then click on "Configure System" 
    • Step 2.2: Search for the "Cloud" section. There, create a new Cloud item and configure it.
  • Step 3: After creating the image and configuring the plugin, create a new job and configure it to restrict where the project can be run to a specific label. That label will be the name you previously set to the Cloud in the Jenkins configuration and will appear as soon as you start writing in the text box.
Now, every time you launch your job, a new Jenkins replica will be provisioned as a container and your build steps will be run inside that container. As soon as the job is finished, your container replica will be automatically dropped.

Ok, fine. I want to test my application written in Java. Do I need to create a specific container with Java preinstalled?

Bitnami can help with easy-to-use, consistent, and up-to-date container images that'll get you up and running in record time. In Bitnami we have base containers for a lot of languages, servers and databases. Our language containers provide an environment already configured to use your application and run your tests using that language. It also comes with all the necessary libraries already compiled. Language-specific containers already in the Bitnami Library are:

  • PHP
  • Ruby

  • NodeJS
  • Java
You can find more information at the Bitnami Docker page, Bitnami Dockerhub or Bitnami Github.

I want to try this as soon as possible, how can I quickly bring up a Jenkins instance with Docker preinstalled?

This feature is currently live, and is included with Bitnami Jenkins 1.631 and later. We recently released Bitnami Jenkins 1.635. You can find the virtual machines here and cloud images at Amazon EC2, Google, VMware vCloud Air and Azure.

Have questions about Bitnami Jenkins with Docker and container replicas? Post to our community forum, and we would be happy to help you.


Thursday, November 12, 2015

Jenkins 1.638 security release

The Jenkins project has just released a new version that fixes multiple security issues, including a fix for the CLI 0-day.

It is strongly suggested that you update your Jenkins website to the latest version.

You can find more info about these issue at this Jenkins Security Advisory.

We have released Bitnami Jenkins 1.638 installers, virtual machines and Amazon EC2, Google, VMware vCloud Air, DigitalOcean, Oracle and Azure cloud images that fix these issues.

Have questions about Bitnami Jenkins or the security issue? Post to our community forum, and we would be happy to help you.

Tuesday, May 19, 2015

Bitnami applications available in the OpenStack Community App Catalog

Today the Open Stack Foundation announced a new resource for sharing applications and developer tools during a keynote at the OpenStack Summit. The Community App Catalog — now available in beta — is open for contributions and will be curated by the community.

Five Bitnami stacks are featured the inaugural community catalog, including MEAN, Jenkins, Ruby Stack, LAMP Stack, Wordpress. This gives cloud users and developers point-and-click access to the applications, as well as a way to collaborate and access new technologies in the OpenStack ecosystem.

Bitnami is pleased to be a part of the effort to make installing cloud stacks and apps easier, alongside products from ActiveState, Google, Oracle and RedHat.

Have you explored the community catalog? We’d love to hear what you think. Share your opinion in the comments below. Or read the announcement from the OpenStack Foundation to learn more.



Tuesday, November 18, 2014

Gradle added to Bitnami Library + Jenkins Stack integration

We're happy to announce that Gradle is now available on the Bitnami Library, as well as its integration with our Jenkins Stack.


Gradle is a Java-based tool that helps you automate the building, testing, publishing and deployment of software packages and other types of projects, such as generated static websites and generated documentation.

The Bitnami Gradle Stack is the best way to run Gradle. We have packed it as a self-contained, pre-configured distribution that includes everything you need to run Gradle. You can get started by downloading our free, ready-to-run installers for Linux, Windows and Mac OS X.


We have also integrated Gradle with the latest version of Jenkins in our Bitnami Jenkins Stack (by enabling and configuring the Gradle Plugin), so you can easily use Gradle for continuous integration of your projects.

If you want to quickly check out our latest Jenkins Stack with Gradle, you can launch a free cloud demo server. By clicking the button below, you will get your own Jenkins instance running, free of cost, for 1 hour!


You can also download our free, ready-to-run Jenkins Stack installers, Virtual Machine images and Cloud Images for Amazon, Azure and Google Clouds.

Tuesday, May 22, 2012

Using Git with the BitNami Jenkins Stack

We are happy to announce that we have released a new version of the BitNami Jenkins Stack. Along with the upgrade to latest version, we are also including the Git plugin with Jenkins by default. It is now possible to use Jenkins to build git-based projects without setting additional binaries or plugins.

Jenkins can clone git repositories as source code for building one or more tasks, similar to how it works for cvs and subversion. With git, it is possible to both have Jenkins check the git repository for changes periodically and set up a hook to notify Jenkins about a commit. Setting up Jenkins to poll periodically is easier and therefore we will use this method in this example. Setting up push notifications is intended for more experienced git and Jenkins users and is described in the push notification from repository section of the Jenkins Git Plugin homepage.

To get started, we can create a new task that will use git as its source code repository. The 'Source Code Management' section of new and existing tasks will now allow selecting 'Git' for source code. We can set up local repositories by specifying the directory of the repository as well as remote repositories using the URL in the form of 'ssh://user@remoteserver/repository.git'. Some servers provide read-only access using git protocol - such as GitHub, where it is 'git://github.com/username/repository.git'.



For a simple repository with just the 'master' branch, that will be enough for Jenkins to retrieve the source code and automatically build it.

We can also set up Jenkins to poll the SCM for changes. To do this, simply go to 'Build Triggers' and enable 'Poll SCM'. This causes a text area for providing a schedule to be shown. The format is same as in 'crontab', so '*/5 * * * *' causes Jenkins to check for changes every 5 minutes.



We should also set up how our application is built. For this example, we can simply create 'script.sh' in our git repository, set its permissions to '0755' and run it from Jenkins to build our application. To do this, go to the 'Build' section of the task, choose 'Execute shell' from the 'Add build step' dropdown and specify the shell script to run:



One very interesting feature of the Jenkins git plugin is that it can be used to build any branch. By default the 'Branch Specifier' is empty, which indicates Jenkins should check all branches for changes. This may be convenient for some branches - such as 'master' being the current version and 'legacy' being the previous version, which is still being maintained. If more than one branch is modified, Jenkins runs multiple builds for the task - one for each branch.

However, in many cases not all branches should be built whenever a change occurs. To only build the two branches above, we can set 2 branch specifiers as follows:



With this setup, whenever a change is pushed to 'master' or 'legacy' branch, they are automatically built when Jenkins fetches the changes and detects an update.

Friday, April 27, 2012

New version of Jenkins, Upgrading your BitNami Jenkins Stack

Last week we announced the first version of our BitNami Jenkins Stack. This week a new Jenkins version was announced and we have already updated our stack. However, in some cases it is more convenient to upgrade the installation in place than re-installing. This post explains briefly how to upgrade a Jenkins installation manually.

The first step is to understand where the JENKINS_HOME variable is pointing to. That directory is where all your data is stored.

In BitNami we define JENKINS_HOME in the apache-tomcat/conf/Catalina/localhost/jenkins.xml file pointing to apps/jenkins/jenkins_home. If you want to upgrade Jenkins keeping your data, you just need to download the latest jenkins.war file, copy it in your apache-tomcat/webapps directory and restart Tomcat. It is recommended to create a backup of the previous jenkins.war file, just in case you find issues when upgrading.


On Linux and OSX you can execute the following steps to perform the above (notice that the installation directory is /opt/bitnami in the BitNami virtual appliances and BitNami Amazon Images):


$ cd <installation_directory>
$ ./ctlscript.sh stop
$ cp apache-tomcat/webapps/jenkins.war apps/jenkins/jenkins.war.bak
$ wget http://mirrors.jenkins-ci.org/war/latest/jenkins.war
$ mv jenkins.war apache-tomcat/webapps/
$ ./ctlscript.sh start


On Windows you can stop the servers from the Start Menu entry or using the graphical tool that you can find in your installation directory. Using the file explorer go to where you installed the BitNami Jenkins Stack. Copy the jenkins.war file from the apache-tomcat/webapps directory to apps/jenkins. Download the latest jenkins.war file and copy it in apache-tomcat/webapps. Now just start the server from the Start Menu or using the graphical tool.

Alternatively to the process above, you can download a new BitNami Jenkins Stack. You can install it to a different location (remember to stop the previous install so there are no port conflicts) and point it to your previous JENKINS_HOME path by editing the file  apache-tomcat/conf/Catalina/localhost/jenkins.xml.


Thursday, April 19, 2012

Continuous Integration with Jenkins and BitNami



If you are a developer, you are probably already familiar with Jenkins. Previously known as Hudson, Jenkins is an open source continuous integration server built with Java that supports building and testing virtually any project. It supports different SCM tools, can execute Apache Ant and Apache Maven-based projects as well as arbitrary shell scripts and Windows batch commands, can monitor executions of remote tasks and more. Hundreds of plugins are also available that you can use for configuring your own system based on your specific requirements.


Today, we are happy to announce a first version of our BitNami Jenkins Stack. It includes Apache Tomcat 7.0.27 and the latest (and greatest) available Jenkins version, Jenkins 1.460. As always, you can get the native installers, virtual appliances and AMIs for the Amazon Cloud.



Here are a few notes on the default BitNami configuration:

- Jenkins is configured with Tomcat. For starting Tomcat you can use our Graphical Manager Tool or the ctlscript.sh utility both included in the installation directory (the installation directory is /opt/bitnami in Virtual Machines and AMIs). On Windows, Tomcat is installed as a service and it will automatically start at boot time.

- The JENKINS_HOME variable will point to apps/jenkins/jenkins_home in your installation directory.

- We configure the stack with the standard security setup. The access control is Jenkins's own user database as security realm and we use the Project-based Matrix Authorization Strategy. During the installation process, you will be prompted to enter the administrator user credentials, which by default will be user/bitnami in Virtual Appliances and AMIs. Notice that Anonymous login and user sign up are disabled. After login, you can easily change these settings through the Jenkins Web interface.




If you haven't had the chance to take a look at Jenkins yet, you no longer have an excuse! We know that you will find Jenkins to be a great and flexible is tool, both in the web interface and the APIs it provides. We would like to hear about your experience when trying BitNami Jenkins (good or bad) in any of its flavors (native installers, virtual machines or AMIs).

If you are already familiar with Jenkins, we would love to hear from you as well. We know there are lot of possible configurations with Jenkins and third party components and we would like to get your feedback on how to improve the BitNami Jenkins Stack.

BitNami Jenkins we will be very soon available in BitNami Cloud Hosting too!