Description
Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server.
Remediation
References
https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2841
http://www.openwall.com/lists/oss-security/2023/04/13/3
Related Vulnerabilities
CVE-2022-45935 Vulnerability in maven package org.apache.james:james-server-data-file
CVE-2022-24429 Vulnerability in npm package convert-svg-core
CVE-2023-26109 Vulnerability in npm package node-bluetooth-serial-port
CVE-2020-5411 Vulnerability in maven package org.springframework.batch:spring-batch-core