GHSA-m8x2-4gc8-9v3r

Source

https://github.com/advisories/GHSA-m8x2-4gc8-9v3r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-m8x2-4gc8-9v3r/GHSA-m8x2-4gc8-9v3r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m8x2-4gc8-9v3r

Aliases

CVE-2018-1000605

Published

2022-05-14T02:56:39Z

Modified

2023-11-08T03:59:39.268458Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

Jenkins CollabNet Plugin man in the middle vulnerability

Details

A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java that allows attackers to impersonate any service that Jenkins connects to. CollabNet Plugin 2.0.5 and newer no longer does that. It instead requires users to opt in to disabling SSL/TLS certificate validation by setting the system property hudson.plugins.collabnet.CollabNetPlugin.skipSslValidation to true. This feature applies to connections by this plugin only.

Database specific

{
    "nvd_published_at": "2018-06-26T17:29:00Z",
    "github_reviewed_at": "2022-12-12T17:01:53Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-295"
    ]
}

References

Affected packages

Maven / org.jenkins-ci.plugins:collabnet

Package

Name: org.jenkins-ci.plugins:collabnet; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/collabnet

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.5

Affected versions

1.*

1.1.6

1.1.7

1.1.8

1.1.9

1.1.10

1.2.0

2.*

2.0.1

2.0.2

2.0.3

2.0.4

Database specific

{
    "last_known_affected_version_range": "<= 2.0.4"
}