GitHub Advisoryadvisory · Maven

GHSA-rv9g-67f7-grq7 Missing SSH host key validation in Mac Plugin

MEDIUM Published 2022-05-24 Modified 2023-01-14 Official page ↗
Aliases
CVE-2020-2146
Ecosystem
Maven
Packages
fr.edf.jenkins.plugins:mac
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-347
Reviewed
2023-01-14

Affected packages

• Maven fr.edf.jenkins.plugins:mac: < 1.2.0 → fixed in 1.2.0

Description

Mac Plugin 1.1.0 and earlier does not use SSH host key validation when connecting to Mac Cloud host launched by the plugin. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents. Mac Plugin 1.2.0 validates SSH host keys when connecting to agents.

Related

Alias · CVE (1)

  • CVE-2020-2146 Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling… vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References