CVE-2025-64135: Jenkins Eggplant Runner Plugin - Protection Mechanism Disabled
Summary
CVE-2025-64135: Jenkins Eggplant Runner Plugin protection mechanism disabled. Affects io.jenkins.plugins:eggplant-runner versions < 0.0.1.301.v963cffe8ddb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Eggplant Runner Plugin is a tool designed to facilitate the integration of Eggplant testing capabilities within Jenkins, a widely-used open-source automation server. This plugin allows users to run Eggplant tests as part of their continuous integration and delivery pipelines, enhancing the testing process. However, a significant vulnerability has been identified in versions 0.0.1.301.v963cffe8ddb and earlier, which compromises the security of the Java runtime environment.
Vulnerability Detail
The Jenkins Eggplant Runner Plugin sets the Java system property 'jdk.http.auth.tunneling.disabledSchemes' to an empty value as part of its proxy configuration. This action disables a critical protection mechanism in the Java runtime that addresses CVE-2016-5597, potentially exposing applications to unauthorized access and security breaches. As of now, there is no fix available for this vulnerability, leaving systems using the affected plugin at risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the Jenkins Eggplant Runner Plugin until a patch is provided. Additionally, ensure that your Java environment is configured securely to minimize exposure to vulnerabilities.
Conclusion
The Jenkins Eggplant Runner Plugin has a significant vulnerability that disables a crucial security feature in the Java runtime. Users are advised to monitor for updates and consider alternative solutions until a fix is available. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for io.jenkins.plugins:eggplant-runner →
FAQ
CVE-2025-64135 is a vulnerability in the Jenkins Eggplant Runner Plugin that disables a critical security mechanism in the Java runtime.
Versions 0.0.1.301.v963cffe8ddb and earlier of the Jenkins Eggplant Runner Plugin are affected by this vulnerability.
The vulnerability may expose applications to unauthorized access, leading to security breaches and data leaks.
As of now, there is no fix available for the Jenkins Eggplant Runner Plugin regarding this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
