{"id":"CVE-2025-64135","aliases":["EUVD-2025-36648","GHSA-w5r3-gr8w-7fj5"],"status":"published","title":"Jenkins Eggplant Runner Plugin protection mechanism disabled","description":"Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00322,"percentile":0.25355,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1188"],"published":"2025-10-29T13:29:42Z","modified":"2026-10-08T11:10:00Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.jenkins.plugins:eggplant-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.1.301.v963cffe8ddb"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.jenkins.plugins:eggplant-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.1.301.v963cffe8ddb"}]}],"versions":["0.0.1.104.v6a_2d3791d289","0.0.1.108.v32f1564b_19d0","0.0.1.159.v8ed1d9f67f00","0.0.1.17.v1579c75fa_144","0.0.1.185.v9617008ee458","0.0.1.189.v1e3397db_cee8","0.0.1.191.v72dea_07931b_6","0.0.1.22.v5e23a_10537ed","0.0.1.226.v1a_ff67035775","0.0.1.247.va_7031a_586298","0.0.1.252.v8e47de80211e","0.0.1.255.vd38258d75ca_6","0.0.1.259.va_548428d4b_79","0.0.1.261.v52442e5f8514","0.0.1.265.v56273b_eece56","0.0.1.270.vcb_9192a_2c004","0.0.1.272.vb_d9081425367","0.0.1.274.ve12295250d73","0.0.1.278.ve95892534fd1","0.0.1.279.vd472e8e0965d","0.0.1.280.vfc393dfee9f1","0.0.1.284.va_b_a_6107c0515","0.0.1.285.v30ff1ea_cd533","0.0.1.300.v6280c46cd670","0.0.1.34.vb_8a_19b_008b_35","0.0.1.38.vdc88180eb_3f4","0.0.1.42.vc410c4e864e6","0.0.1.51.vdb_9cc3a_88828","0.0.1.57.v2b_a_a_c5a_e82db_","0.0.1.59.v14e07b_c80752","0.0.1.78.va_45a_c4d43557","0.0.1.80.vf3e498a_e2995","0.0.1.85.vfb_43a_f521988"]}],"products":[{"vendor":"jenkins","product":"eggplant_runner"},{"vendor":"jenkins project","product":"jenkins eggplant runner plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3326","tags":["vendor-advisory","Vendor Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/10/29/2","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64135","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w5r3-gr8w-7fj5"},{"url":"https://github.com/jenkinsci/eggplant-runner-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-64135","description":"Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime.","status":"published","published":"2025-10-29T13:29:42.358Z","modified":"2025-11-04T21:14:27.669Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:32:46.750177Z"}],"euvd":[{"id":"EUVD-2025-36648","description":"Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime.","status":"published","published":"2025-10-29T13:29:42Z","modified":"2025-11-04T21:14:27Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:20.707326Z"}],"ghsa":[{"id":"GHSA-w5r3-gr8w-7fj5","title":"Jenkins Eggplant Runner Plugin protection mechanism disabled","description":"Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value as part of applying a proxy configuration.\n\nThis disables a protection mechanism of the Java runtime addressing CVE-2016-5597.\n\nAs of publication of this advisory, there is no fix.","status":"published","published":"2025-10-29T15:31:56Z","modified":"2025-11-05T20:52:37Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:39:07.0252Z"}],"nvd":[{"id":"CVE-2025-64135","description":"Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime.","status":"published","published":"2025-10-29T14:15:57.773Z","modified":"2026-10-08T11:10:00.25Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:11:41.607433Z"}],"osv":[{"id":"GHSA-w5r3-gr8w-7fj5","title":"Jenkins Eggplant Runner Plugin protection mechanism disabled","description":"Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value as part of applying a proxy configuration.\n\nThis disables a protection mechanism of the Java runtime addressing CVE-2016-5597.\n\nAs of publication of this advisory, there is no fix.","status":"published","published":"2025-10-29T15:31:56Z","modified":"2025-11-05T21:08:42.002199Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T15:46:58.04805Z"}]}}