PT-2019-11719 · Jenkins · Jenkins Sitemonitor Plugin+1

Daniel Beck · CVE-2019-10317 · Publicado 2019-04-30 · Atualizado 2023-10-25

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins SiteMonitor Plugin version 0.5 and earlier

Description The issue concerns the Jenkins SiteMonitor Plugin, which unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM. This means that the plugin does not verify the identity of the server it is connecting to, making it vulnerable to man-in-the-middle attacks. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For Jenkins SiteMonitor Plugin version 0.5 and earlier, update the plugin to a version that has the opt-in option to ignore SSL/TLS errors for each site check individually, as the newer version no longer unconditionally disables SSL/TLS certificate validation.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2019-10317

GHSA-23C2-W636-5RHM

Produtos afetados

Jenkins

Jenkins Sitemonitor Plugin

Referências · 7

• http://openwall.com/lists/oss-security/2019/04/30/5 · Nota
• https://web.archive.org/web/20200227073756/http://securityfocus.com/bid/108159 · Nota
• http://securityfocus.com/bid/108159 · Nota
• https://jenkins.io/security/advisory/2019-04-30/#SECURITY-930 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-23c2-w636-5rhm · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10317 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10317 · Nota de Segurança