Windows -- Upgrading in place doesn't update version information in Add/Remove Programs

Using Jenkins Ask a question
1

We run automated vulnerability scans of our Windows hosts that collect software inventory and inspect program version information from what I suspect is the registry. We also keep Jenkins up to date using the Upgrade Automatically feature in the Web UI. However, even though the Jenkins Web UI shows that we are using version 2.387.2, Add/Remove programs shows that we are using v2.222.4 which gets reported to our vulnerability scanner (and thus creates critical security findings) which then creates headaches for me because I have to explain to the InfoSec auditors that we really aren’t on that old version.

Is there a way to get the registry or Add/Remove programs to display the currently installed version of Jenkins?

2

No, this is a registry value that is only updated during install via the MSI. It wouldn’t be safe for Jenkins itself to update the registry value during an in place update, as it would require elevation to do so.

3

I am experiencing this with the .msi installer for both version 2.426 and 2.427. I stopped the Jenkins service, ran the upgrade with the .msi installer and although Jenkins is upgraded, the version in Windows > Programs and Features is still the older 2.255.4270. This is showing up on a vulnerability scan list so I need to get this version updated soon to get IT off my back.