GitHub Advisoryadvisory · Maven

GHSA-9m92-qwpc-qm78 Jenkins SAML Single Sign On(SSO) Plugin unconditionally disables SSL/TLS certificate validation

MEDIUM Published 2023-05-16 Modified 2023-05-17 Official page ↗
Aliases
CVE-2023-32994
Ecosystem
Maven
Packages
io.jenkins.plugins:miniorange-saml-sp
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-295
Reviewed
2023-05-17

Affected packages

• Maven io.jenkins.plugins:miniorange-saml-sp: < 2.2.0 → fixed in 2.2.0

Description

Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections. SAML Single Sign On(SSO) Plugin 2.2.0 performs SSL/TLS certificate validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata.

Related

Alias · CVE (1)

  • CVE-2023-32994 Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References