PT-2019-11777 · Jenkins · Jenkins Codefresh Integration Plugin+1

Daniel Beck · Published 2019-08-07 · Updated 2023-10-25 · CVE-2019-10381

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Codefresh Integration Plugin versions 1.8 and earlier

Description The issue concerns the Jenkins Codefresh Integration Plugin, which unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM. This means that the plugin disables the verification of SSL/TLS certificates, potentially allowing malicious connections to be established without being detected. As of the latest information, there is no fix available for this issue.

Recommendations For Jenkins Codefresh Integration Plugin versions 1.8 and earlier, as a temporary workaround, consider disabling the plugin until a patch is available to prevent the disabling of SSL/TLS certificate validation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2019-10381

GHSA-862J-CV9P-6HPF

Affected Products

Jenkins

Jenkins Codefresh Integration Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-10381 · Security Note
• https://osv.dev/vulnerability/GHSA-862j-cv9p-6hpf · Vendor Advisory
• https://jenkins.io/security/advisory/2019-08-07/#SECURITY-931 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10381 · Vendor Advisory
• http://openwall.com/lists/oss-security/2019/08/07/1 · Note