GitHub Advisoryadvisory · Maven

GHSA-m8x2-4gc8-9v3r Jenkins CollabNet Plugin man in the middle vulnerability

MEDIUM Published 2022-05-14 Modified 2022-12-12 Official page ↗
Aliases
CVE-2018-1000605
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:collabnet
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-295
Reviewed
2022-12-12

Affected packages

• Maven org.jenkins-ci.plugins:collabnet: < 2.0.5 → fixed in 2.0.5

Description

A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java that allows attackers to impersonate any service that Jenkins connects to. CollabNet Plugin 2.0.5 and newer no longer does that. It instead requires users to opt in to disabling SSL/TLS certificate validation by setting the system property hudson.plugins.collabnet.CollabNetPlugin.skipSslValidation to true. This feature applies to connections by this plugin only.

Related

Alias · CVE (1)

  • CVE-2018-1000605 A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java,… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References