Jenkins Eggplant Runner Plugin Java Protection Mechanism Disabled Vulnerability

A vulnerability exists in the Jenkins Eggplant Runner Plugin in versions through 0.0.1.301.v963cffe8ddb_8. The plugin disables a Java runtime protection mechanism by setting the system property 'jdk.http.auth.tunneling.disabledSchemes' to an empty value. This change removes a safeguard intended to prevent certain types of authentication tunneling vulnerabilities.

Impact

Disabling the Java protection mechanism related to authentication tunneling could potentially expose the application to vulnerabilities similar to CVE-2016-5597, allowing for unauthorized authentication tunneling.