Description

Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server.

Remediation

References

https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1813

http://www.openwall.com/lists/oss-security/2020/09/16/3

Related Vulnerabilities

CVE-2023-32070 Vulnerability in maven package org.xwiki.rendering:xwiki-rendering-macro-html

CVE-2023-43499 Vulnerability in maven package com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

CVE-2022-46751 Vulnerability in maven package org.apache.ivy:ivy

CVE-2023-37582 Vulnerability in maven package org.apache.rocketmq:rocketmq-namesrv

CVE-2022-23307 Vulnerability in maven package org.apache.logging.log4j:log4j

Severity

Medium

Classification

CWE-295 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Tags

Vendor Advisory Third Party Advisory