Jenkins JEP-200: Enforcing class deserialization whitelists

YouTube Speaker Deck

Heads-up on JEP-200, which switched the Jenkins Remoting/XStream blacklist to a whitelist, and how to prepare.

Tags: jenkins security

Slides

Abstract

This presentation provides heads-up about the incoming release of Jenkins JEP-200 "Switch Remoting/XStream blacklist to whitelist". The change has landed in Jenkins LTS 2.107.1.

Target audience: Jenkins administrators and plugin maintainers. What to expect from JEP-200? How to upgrade? How to test changes? And how to verify your plugins?

Video

References

Presented at

  • Jenkins Online Meetup, March 2018
  • Jenkins Contributor Summit, 2018
  • Jenkins World & DevOps World, 2018