medium5.9
CVE-2025-64135
Jenkins Eggplant Runner Plugin protection mechanism disabled
Impact
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value as part of applying a proxy configuration. This disables a protection mechanism of the Java runtime addressing CVE-2016-5597. As of publication of this advisory, there is no fix.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.jenkins.plugins:eggplant-runner | <= 0.0.1.301.v963cffe8ddb | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Eggplant Runner | through 0.0.1.301.v963cffe8ddb_8 |