GitHub Advisoryadvisory · Maven

GHSA-hrr3-7r5v-vxx5 Jenkins Inedo BuildMaster Plugin globally and unconditionally disabled SSL/TLS certificate validation

HIGH Published 2022-05-14 Modified 2024-01-30 Official page ↗
Aliases
CVE-2018-1999035
Ecosystem
Maven
Packages
com.inedo.buildmaster:inedo-buildmaster
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2024-01-30

Affected packages

• Maven com.inedo.buildmaster:inedo-buildmaster: < 2.0 → fixed in 2.0

Description

A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMasterApi.java that allows attackers to impersonate any service that Jenkins connects to.

Related

Alias · CVE (1)

  • CVE-2018-1999035 A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java,… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References