PT-2020-15357 · Jenkins · Jenkins Mabl Plugin+1

Nils Emmerich · Published 2020-03-09 · Updated 2023-10-25 · CVE-2020-2146

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Mac Plugin versions 1.1.0 and earlier

Description The issue concerns the lack of SSH host key validation when connecting agents created by the plugin, which could enable man-in-the-middle attacks. This allows an attacker to intercept connections to build agents.

Recommendations For Jenkins Mac Plugin versions 1.1.0 and earlier, update to version 1.2.0 or later, which includes SSH host key validation when connecting to agents.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2020-2146

GHSA-RV9G-67F7-GRQ7

Affected Products

Jenkins

Jenkins Mabl Plugin

References · 8

• https://osv.dev/vulnerability/GHSA-rv9g-67f7-grq7 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2146 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2146 · Vendor Advisory
• https://github.com/jenkinsci/mac-plugin/commit/ba1a8206c7ef990d37498e5abdf210990ef046b5 · Note
• https://github.com/jenkinsci/mac-plugin · Note
• http://openwall.com/lists/oss-security/2020/03/09/1 · Note
• https://t.me/cvenotify/1405 · Telegram Post