I've been using rpm -q --changelog package_name to check if a certain cve vulnerability has been patched on my system. However, when I'm doing the same for jenkins, all I got was

I went to the website and saw no cve-related information. I ran rpm -q jenkins and yum info jenkins, both return version 2.73.2, which seems to indicate that I'm on the latest version? Is this good enough to ensure my Jenkins is secure?



Determining whether a package contains a given patch depends on where you got the package. Regardless of the changelog contents, packages will (barring reverts to fix bugs) contain all the fixes of the version they declare; so if your Jenkins RPM says it’s version 2.73.2, it contains everything in Jenkins 2.73.2. In addition to that, packages can contain additional security fixes, which will usually be mentioned in the package’s changelog — but that’s usually only the case for distribution-provided packages (i.e. in your case, packages which come directly from CentOS, or possibly repositories such as EPEL which follow distribution practices).

However in your case I suspect your version of Jenkins is rather out of date (2.73.2 was released in October 2017, and your changelog doesn’t look like a distribution package’s changelog so I wouldn’t expect any additional security fixes). The current LTS Jenkins release is 2.150.1 (over a year newer than your release), available from the Jenkins RPM repository.

If you have OpenShift, the current supported release available in Red Hat repositories is

  • Thank you for you insight and the link. I'm not sure where the package came from but I suppose it's best to update to the latest version anyway. – x7qiu Jan 9 at 9:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.