Description

Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-middle attacks.

Remediation

References

http://www.openwall.com/lists/oss-security/2020/05/06/3

https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1528

Related Vulnerabilities

CVE-2022-25967 Vulnerability in npm package eta

CVE-2019-10282 Vulnerability in maven package hudson.plugins.klaros:klaros-testmanagement

CVE-2022-36904 Vulnerability in maven package org.jenkins-ci.plugins:repository-connector

CVE-2023-43502 Vulnerability in maven package com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

CVE-2022-45135 Vulnerability in maven package org.apache.cocoon:cocoon-databases-impl

Severity

Medium

Classification

CWE-295 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Mailing List Third Party Advisory Vendor Advisory