Description
A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that disables host key verification by default.
Remediation
References
https://jenkins.io/security/advisory/2018-03-26/#SECURITY-630
Related Vulnerabilities
CVE-2015-0254 Vulnerability in maven package taglibs:standard
CVE-2013-2135 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2020-14389 Vulnerability in maven package org.keycloak:keycloak-core
CVE-2018-1000188 Vulnerability in maven package org.jenkins-ci.plugins:cas-plugin
CVE-2020-1698 Vulnerability in maven package org.keycloak:keycloak-authz-client