GitHub Advisoryadvisory · Maven

GHSA-j54r-w587-95q7 Jenkins Oracle Cloud Infrastructure Compute Plugin missing SSH host key validation

MEDIUM Published 2023-07-12 Modified 2023-07-12 Official page ↗
Aliases
CVE-2023-37948
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-20
Reviewed
2023-07-12

Affected packages

• Maven org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute: < 1.0.17 → fixed in 1.0.17

Description

Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not perform SSH host key validation when connecting to OCI clouds. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to OCI clouds. Oracle Cloud Infrastructure Compute Plugin 1.0.17 provides strategies for performing host key validation for administrators to select the one that meets their security needs.

Related

Alias · CVE (1)

  • CVE-2023-37948 Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not validate SSH host keys when connecting OCI clouds, enabling… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References