Check Jenkins 2017-04-26 security advisory

Originally created by @intrigeri on #12596 (Redmine)

Forwarded on Apr 27, pinged on May 16, no reply => let’s track this on a ticket instead of trusting email.

Are we affected? Anything we should do to fix it?