PT-2018-9321 · Jenkins · Jenkins Ansible Plugin+1

Daniel Beck · Publicado 2018-04-05 · Atualizado 2022-05-13 · CVE-2018-1000149

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins Ansible Plugin versions 0.8 and older

Description A man in the middle issue exists due to the disabling of host key verification by default in several Java files, including AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, and AnsiblePlaybookStep.java. This issue is resolved in version 1.0 of the Ansible Plugin, which enables host key verification by default and provides options for users to opt out.

Recommendations For Jenkins Ansible Plugin versions 0.8 and older, update to version 1.0 or newer to enable host key verification by default. As a temporary workaround, consider configuring the plugin to enable host key verification manually until a patch is available.

Correção

Identificadores relacionados

CVE-2018-1000149

GHSA-322X-JV5H-CVJH

Produtos afetados

Jenkins

Jenkins Ansible Plugin

Referências · 5

• https://github.com/jenkinsci/ansible-plugin/commit/06d30e5b626a978e258a7f4ab473cd7f53a7cba7 · Nota
• https://osv.dev/vulnerability/CVE-2018-1000149 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-322x-jv5h-cvjh · Aviso do Fabricante
• https://jenkins.io/security/advisory/2018-03-26/#SECURITY-630 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000149 · Nota de Segurança