PT-2019-11840 · Jenkins · Jenkins Cadence Vmanager Plugin+1

Daniel Beck · Published 2019-10-16 · Updated 2023-10-25 · CVE-2019-10446

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Cadence vManager Plugin versions prior to 2.7.1

Description The issue concerns the disabling of SSL/TLS and hostname verification globally for the Jenkins master JVM. This affects the security of the Jenkins master JVM, potentially exposing it to man-in-the-middle attacks or other security risks. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For Jenkins Cadence vManager Plugin versions prior to 2.7.1, update to version 2.7.1 or later to resolve the issue. As a temporary workaround, consider re-enabling SSL/TLS and hostname verification globally for the Jenkins master JVM until the update can be applied.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2019-10446

GHSA-5J9F-5WMP-7F8H

Affected Products

Jenkins

Jenkins Cadence Vmanager Plugin

References · 6

• https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10446 · Security Note
• https://osv.dev/vulnerability/GHSA-5j9f-5wmp-7f8h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10446 · Vendor Advisory
• https://github.com/jenkinsci/vmanager-plugin · Note
• https://github.com/jenkinsci/vmanager-plugin/commit/639aa135ab57d9e23c5bedeb0a5e9518eb0f486e · Note