Description
Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks.
Remediation
References
https://jenkins.io/security/advisory/2020-05-06/#SECURITY-381
http://www.openwall.com/lists/oss-security/2020/05/06/3
Related Vulnerabilities
CVE-2015-3250 Vulnerability in maven package org.apache.directory.api:api-all
CVE-2021-40823 Vulnerability in npm package matrix-js-sdk
CVE-2023-46233 Vulnerability in maven package org.webjars.bowergithub.brix:crypto-js
CVE-2018-10912 Vulnerability in maven package org.keycloak:keycloak-model-infinispan
CVE-2023-22893 Vulnerability in npm package @strapi/plugin-users-permissions