Description
It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks.
Remediation
References
https://jenkins.io/security/advisory/2017-03-20/
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2648
http://www.securityfocus.com/bid/96985
Related Vulnerabilities
CVE-2012-0392 Vulnerability in maven package com.opensymphony:xwork-core
CVE-2010-3449 Vulnerability in maven package org.codehaus.redback:redback-system
CVE-2016-8629 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2022-25967 Vulnerability in npm package eta
CVE-2013-2165 Vulnerability in maven package org.richfaces.core:richfaces-core-impl