Description

Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.

Remediation

References

https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1481

Related Vulnerabilities

CVE-2011-4838 Vulnerability in maven package org.jruby:jruby

CVE-2014-3488 Vulnerability in maven package io.netty:netty

CVE-2014-0109 Vulnerability in maven package org.apache.cxf:cxf-bundle

CVE-2013-1921 Vulnerability in maven package org.picketbox:jbosssx-bare

CVE-2023-37471 Vulnerability in maven package org.openidentityplatform.openam:openam-federation-library

Severity

High

Classification

CWE-295 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Tags

Vendor Advisory