Description
A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that disables host key verification by default.
Remediation
References
https://jenkins.io/security/advisory/2018-03-26/#SECURITY-630
Related Vulnerabilities
CVE-2018-6874 Vulnerability in maven package org.webjars.bower:auth0-lock
CVE-2019-1003038 Vulnerability in maven package org.jenkins-ci.plugins:repository-connector
CVE-2019-1003031 Vulnerability in maven package org.jenkins-ci.plugins:matrix-project
CVE-2023-50728 Vulnerability in npm package octokit
CVE-2014-6439 Vulnerability in maven package org.elasticsearch:elasticsearch