GitHub Advisoryadvisory · Maven

GHSA-qgp8-h5cp-r75r Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation

MEDIUM Published 2022-05-24 Modified 2023-10-26 Official page ↗
Aliases
CVE-2019-10444
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:bumblebee
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-295
Reviewed
2023-10-26

Affected packages

• Maven org.jenkins-ci.plugins:bumblebee: < 4.1.4 → fixed in 4.1.4

Description

Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation for connections to the HP ALM service. Bumblebee HP ALM Plugin no longer does that. Instead, it now allows users to opt out of certificate validation.

Related

Alias · CVE (1)

  • CVE-2019-10444 Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References