Resolve open vulnerabilities

[schlumpfit]

Jenkins and plugins versions report

Jenkins: 2.426.2
OS: Linux - 5.10.201-191.748.amzn2.x86_64
Java: 17.0.9 - Eclipse Adoptium (OpenJDK 64-Bit Server VM)

oic-auth:2.6

What Operating System are you using (both controller, and any agents involved in the problem)?

Not relevant.

Reproduction steps

1. Login to Jenkins controller or check Plugin page: https://plugins.jenkins.io/oic-auth/

Expected Results

No vulnerabilities are shown.

Actual Results

Two open vulnerabilities are shown.

Anything else?

Hello there, I am interested if there are already any efforts made in resolving the issues?
For me it is unclear if anything is going to happen or if these issues have been reported and that is the status quo.

I guess it is fine to ask it "publicly" since they are already displayed publicly on the plugins website

Are you interested in contributing a fix?

No response

[krscheetas]

Hi all, thanks for working on this. I see that a PR regarding CVE-2023-50771 has been merged. When will this be released to the Jenkins Plugin Servers so we can get it into our instance?

[dR3b]

What's going on here? Someone has to take responsibility and create a new release!!!
Thanks!

[pascal-hofmann]

@michael-doubez Can you create a new release?

[franciscomfcmaia]

Sooo jenkins has no openid plugin without vulnerabilities? Whats going on here? xD

[tumbl3w33d]

Yet another case of https://xkcd.com/2347/

The plugin project is looking for maintainers by the way.

For those who cannot wait, there's a release built from my fork that was merged. Or you could fork the master branch of this repo yourself and add the github action to create your own release.

[michael-doubez]

Well. I had to fix the code and the tests - silly me merging a PR that fails.
f0d703f

At the same time, java has been switched to 11+.

It took some time, mainly rebuilding my dev env after I scratched everything.
Whatever 3.0 is out: https://github.com/jenkinsci/oic-auth-plugin/releases/tag/oic-auth-3.0

[michael-doubez]

Still one vulnerability.
I don't have the time to tackle it. Contributions are welcome.

[michael-doubez]

Closing issue.

[michael-doubez]

Activating CD for further contribution #276

[schlumpfit]

Thanks a lot for the great work and fixing this 🎉 👏

[franciscomfcmaia]

This is incredible! Thanks for the amazing work!

[krscheetas]

Thanks all for solving this, but how will the new release be delivered here: https://plugins.jenkins.io/oic-auth/releases/ ?

[michael-doubez]

Thanks all for solving this, but how will the new release be delivered here: https://plugins.jenkins.io/oic-auth/releases/ ?

It already is. But it takes some time to be updated in plugin files.
https://updates.jenkins.io/download/plugins/oic-auth/3.0/oic-auth.hpi