PT-2020-15399 · Jenkins · Jenkins Amazon Ec2 Plugin+1

Raihaan Shouhell · Published 2020-05-06 · Updated 2023-10-25 · CVE-2020-2185

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier

Description The issue concerns a lack of SSH host key validation when connecting agents, which could enable man-in-the-middle attacks to intercept connections to build agents. This could potentially allow unauthorized access or manipulation of data.

Recommendations For Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier, update to version 1.50.2 or later, which provides strategies for performing host key validation and assistance for migrating to a more secure strategy.

Fix

Weakness Enumeration

CWE-300

Related Identifiers

CVE-2020-2185

GHSA-Q8QQ-2P5P-RG44

Affected Products

Jenkins

Jenkins Amazon Ec2 Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-q8qq-2p5p-rg44 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-05-06/#SECURITY-381 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2185 · Security Note
• https://github.com/jenkinsci/ec2-plugin · Note
• https://github.com/jenkinsci/ec2-plugin/commit/4c9f03ae202e4730fd54eda40771fa4d3873e358 · Note
• http://openwall.com/lists/oss-security/2020/05/06/3 · Note