Description
Jenkins Codefresh Integration Plugin 1.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/08/07/1
https://jenkins.io/security/advisory/2019-08-07/#SECURITY-931
Related Vulnerabilities
CVE-2019-15954 Vulnerability in npm package total.js
CVE-2023-22946 Vulnerability in maven package org.apache.spark:spark-core_2.12
CVE-2019-5442 Vulnerability in maven package ro.pippo:pippo-jaxb
CVE-2019-1003087 Vulnerability in maven package org.jenkins-ci.plugins:sinatra-chef-builder
CVE-2022-28156 Vulnerability in maven package com.surenpi.jenkins:phoenix-autotest