Critical Bug in Jenkins - This is why Building a Web Server is Hard
ฝัง
- เผยแพร่เมื่อ 23 ก.ค. 2024
- Jenkins has just released a statement that there is a potential bug (CVE-2019-17638) where an attacker can steal content from other legitimate requests. In this video, I describe the bug and why being a web server is difficult.
2;00 HTTP Smuggling • HTTP Request Smuggling...
7;50 multi-Threading • Asynchronous vs Multit...
Resources
nvd.nist.gov/vuln/detail/CVE-...
en.wikipedia.org/wiki/Jetty_(...)
www.jenkins.io/security/advis...
🏭 Backend Engineering Videos
• Backend Engineering (B...
💾 Database Engineering Videos
• Database Engineering
🛰 Network Engineering Videos
• Network Engineering
🏰 Load Balancing and Proxies Videos
• Proxies
🐘 Postgres Videos
• PostgresSQL
🚢Docker
• Docker
🧮 Programming Pattern Videos
• Programming Patterns
🛡 Web Security Videos
• Web Security
🦠 HTTP Videos
• HTTP
🐍 Python Videos
• Python by Example
🔆 Javascript Videos
• Javascript by Example
👾Discord Server / discord
Become a Member
/ @hnasr
Support me on PayPal
bit.ly/33ENps4
Become a Patreon
/ hnasr
Stay Awesome,
Hussein - วิทยาศาสตร์และเทคโนโลยี
I really admire the way you keep us updated ok such topics which generally skip attention. Kudos .
It's my pleasure Love making this content
Please do a video on Jenkins, by example, pros and cons and whys, you know
I am surprised I understood that :p . Thanks.
@Hussein your content is great, but if you can show the screen recording in full screen that would be nice. Had to strain the eyes to read from it :-)
Will consider this thanks
Hi bro small doubt how transport protocols are used to develop an app
hemanth kala hi, if the app has a client side and a server side pieces than you need a transport protocol to make a call from the client to the server and transmit response from the server back to the client. The communication as a result need to be encrypted most of the time..
can you make a simple video on http request methods?
Since all the needs can be met by get and post dont know where we really need to use put,delete etc
Here I explain the difference between POST and GET, the rest of the methods can actually be used to follow HTTP semantics
th-cam.com/video/K8HJ6DN23zI/w-d-xo.html
Tried haproxy and turned back to traefik because the documentation is too long and oldstyle looking. I also haven't found examples. Basically need to read all the long doc page in order to do something
My experience was the exact opposite Traefik doc was so hard to understand
@@hnasr I also did the opposite of your traefik video. Installed it with docker and also installed node.js server inside docker. I actually now develop inside docker inside upcloud server. Just today it finally works with letsencrypt wildcard domain. Almost all the config is inside docker-compose.
I started from digital ocean and ended with upcloud and even inside docker it's speed is not less than my machine!
I run vscode SSH remote.
All this is very cool.
I see traefik as my sidecar proxy in the future when I will learn kub
There's some open source projects that have their build pipeline public. For example LineageOS which you can find here: buildkite.com/lineageos/. Although they're not using Jenkins.
check KDE build.kde.org/
Is this what you were talking about?
@@leocarvalho8051 yes :)
Is the real one Jenkins or Hudson? I guess it’s just Jenkins now
9:00 "We don't expose jenkins to the public,we only use it internally"
You have much to learn young grasshopper :-)
Companies put Jenkins on a central server somewhere they can access it from the office, home, clients offices etc. And it's all password protected so who needs firewalls, eh?
vinny142 interesting use case is this so they can execute jobs while they are outside the office? Probably valid, thanks for sharing.. than again a user can just login into the office VPN and use it
@@hnasr exactly, server can be anywhere, if is corporate network, probably only way to access Jenkins, it will be via VPN.
@@hnasr epic
@@hnasr Outside the office, at the clients office, spme justwant the customer to be able to see the jenkins reports, whatever. Yes VPN could work but if your Jenkins is at a hosting company that gets more complicated to set up so they ust put a password on it and call it safe. Firewalls people, use the flooping firewalls.