PT-2018-9323 · Jenkins · Jenkins Vsphere Plugin+1

Peter Adkins · Published 2018-04-05 · Updated 2022-05-14 · CVE-2018-1000151

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins vSphere Plugin versions 2.16 and older

Description A man in the middle issue exists due to the disabling of SSL/TLS certificate validation by default in the VSphere.java file. This affects the security of the connection. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For Jenkins vSphere Plugin versions 2.16 and older, update to version 2.17 or newer, which has SSL/TLS certificate validation enabled by default.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2018-1000151

GHSA-VQ7P-F4FV-RR5X

Affected Products

Jenkins

Jenkins Vsphere Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2018-1000151 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vq7p-f4fv-rr5x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000151 · Security Note
• https://jenkins.io/security/advisory/2018-03-26/#SECURITY-504 · Vendor Advisory
• https://github.com/jenkinsci/vsphere-cloud-plugin · Note
• https://github.com/jenkinsci/vsphere-cloud-plugin/commit/f0fb143af340c7529dd9e50f5514334756019356 · Note