PT-2018-9321 · Jenkins · Jenkins Ansible Plugin+1

Daniel Beck · Published 2018-04-05 · Updated 2022-05-13 · CVE-2018-1000149

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins Ansible Plugin versions 0.8 and older

Description A man in the middle issue exists due to the disabling of host key verification by default in several Java files, including AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, and AnsiblePlaybookStep.java. This issue is resolved in version 1.0 of the Ansible Plugin, which enables host key verification by default and provides options for users to opt out.

Recommendations For Jenkins Ansible Plugin versions 0.8 and older, update to version 1.0 or newer to enable host key verification by default. As a temporary workaround, consider configuring the plugin to enable host key verification manually until a patch is available.

Fix

Related Identifiers

CVE-2018-1000149

GHSA-322X-JV5H-CVJH

Affected Products

Jenkins

Jenkins Ansible Plugin

References · 5

• https://osv.dev/vulnerability/CVE-2018-1000149 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-322x-jv5h-cvjh · Vendor Advisory
• https://jenkins.io/security/advisory/2018-03-26/#SECURITY-630 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000149 · Security Note
• https://github.com/jenkinsci/ansible-plugin/commit/06d30e5b626a978e258a7f4ab473cd7f53a7cba7 · Note