Check Jenkins 2017-04-26 security advisory

Originally created by @intrigeri on #12596 (Redmine)

Forwarded on Apr 27, pinged on May 16, no reply => let’s track this on a ticket instead of trusting email.

Are we affected? Anything we should do to fix it?

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information