Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Jenkins
  • Eggplant
  • Jenkins

No data.

No data.

References
Link Providers
https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3326 cve-icon cve-icon
History

Thu, 30 Oct 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Jenkins
Jenkins eggplant
Jenkins jenkins
Vendors & Products Jenkins
Jenkins eggplant
Jenkins jenkins

Wed, 29 Oct 2025 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1188
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Oct 2025 13:45:00 +0000

Type Values Removed Values Added
Description Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: jenkins

Published: 2025-10-29T13:29:42.358Z

Updated: 2025-10-29T14:10:17.455Z

Reserved: 2025-10-28T07:34:37.542Z

Link: CVE-2025-64135

cve-icon Vulnrichment

Updated: 2025-10-29T14:09:57.125Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-10-29T14:15:57.773

Modified: 2025-10-30T15:03:13.440

Link: CVE-2025-64135

cve-icon Redhat

No data.