GitHub Advisoryadvisory · Maven

GHSA-322x-jv5h-cvjh Jenkins Ansible Plugin man in the middle vulnerability

MEDIUM Published 2022-05-13 Modified 2022-12-06 Official page ↗
Aliases
CVE-2018-1000149
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:ansible
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Reviewed
2022-12-06

Affected packages

• Maven org.jenkins-ci.plugins:ansible: < 1.0 → fixed in 1.0

Description

A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in `AbstractAnsibleInvocation.java`, `AnsibleAdHocCommandBuilder.java`, `AnsibleAdHocCommandInvocationTest.java`, `AnsibleContext.java`, `AnsibleJobDslExtension.java`, `AnsiblePlaybookBuilder.java`, `AnsiblePlaybookStep.java` that disables host key verification by default. Ansible Plugin 1.0 now enables host key verification by default, adding options allowing users to opt out.

Related

Alias · CVE (1)

  • CVE-2018-1000149 A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java,… vulnerability

References