Jenkins

Reads the version from the X-Jenkins response header, not the response body — Jenkins sets that header on every response, including a 403 to an unauthenticated request, while the body an authenticated request gets back has no version field anywhere in it.

targets:
  - id: jenkins-main
    product: jenkins
    address: https://jenkins.example.com

Authentication

Optional. A fresh instance with its default security realm answers /api/json with 403 to an anonymous request — that’s not a failure here, X-Jenkins is still set on that same response. Basic auth is accepted if you’d rather authenticate:

credentials:
  jenkins-admin:
    kind: basic
    username: admin
    password: "${JENKINS_TOKEN}"

Recorded fields

• version — from the X-Jenkins header
• extra.mode, extra.useSecurity — only populated when the request was authenticated enough to get a 200 body back; absent on an anonymous 403

CVE correlation

Matched against NVD and БДУ ФСТЭК when a cve: block is configured. Weekly (2.580) and LTS (2.568.3) releases get the same fix under different numbers; since 2.2, the version’s own shape picks the release line, so a fixed LTS is no longer flagged by the weekly range of the same fix — see Edition-aware matching.

Lifecycle resolver

endoflife:jenkins.