Description

It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks.

Remediation

References

http://www.securityfocus.com/bid/96985

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2648

https://jenkins.io/security/advisory/2017-03-20/

Related Vulnerabilities

CVE-2019-16556 Vulnerability in maven package org.jenkins-ci.plugins:rundeck

CVE-2019-0228 Vulnerability in maven package org.apache.pdfbox:pdfbox

CVE-2022-1291 Vulnerability in maven package org.webjars.bowergithub.hhurz:tableexport.jquery.plugin

CVE-2017-16019 Vulnerability in npm package gitbook

CVE-2021-23377 Vulnerability in npm package onion-oled-js

Severity

Medium

Classification

CWE-295 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Third Party Advisory VDB Entry Issue Tracking Vendor Advisory