PT-2025-44284 · Jenkins · Jenkins Eggplant Runner Plugin+1

Pierre Beitz · Published 2025-10-29 · Updated 2025-12-22 · CVE-2025-64135

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Eggplant Runner Plugin versions 0.0.1.301.v963cffe8ddb 8 and earlier

Description The Jenkins Eggplant Runner Plugin versions 0.0.1.301.v963cffe8ddb 8 and earlier configures the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value. This action disables a security feature within the Java runtime environment, potentially weakening protection mechanisms.

Recommendations Update to a newer version of the Jenkins Eggplant Runner Plugin.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2025-64135

GHSA-W5R3-GR8W-7FJ5

Affected Products

Jenkins

Jenkins Eggplant Runner Plugin

References · 9

• https://jenkins.io/security/advisory/2025-10-29/#SECURITY-3326 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w5r3-gr8w-7fj5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64135 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64135 · Security Note
• https://github.com/jenkinsci/eggplant-runner-plugin · Note
• https://twitter.com/CVEnew/status/1983530926354399656 · Twitter Post
• https://t.me/CVEtracker/36057 · Telegram Post
• https://t.me/cveNotify/146531 · Telegram Post
• http://openwall.com/lists/oss-security/2025/10/29/2 · Note