Description
Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.
Remediation
References
https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1481
Related Vulnerabilities
CVE-2016-5398 Vulnerability in maven package org.jbpm:jbpm-designer-client
CVE-2012-0391 Vulnerability in maven package org.apache.struts.xwork:xwork-core
CVE-2023-46998 Vulnerability in maven package org.webjars.bower:bootbox.js
CVE-2021-4178 Vulnerability in maven package io.fabric8:kubernetes-client
CVE-2023-48631 Vulnerability in npm package @adobe/css-tools