PT-2020-15401 · Jenkins · Jenkins Amazon Ec2 Plugin+1

Raihaan Shouhell · Published 2020-05-06 · Updated 2023-10-25 · CVE-2020-2187

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier

Description The issue allows for man-in-the-middle attacks due to the unconditional acceptance of self-signed certificates and the lack of hostname validation when connecting to Windows agents via HTTPS. This could be exploited to intercept connections to build agents.

Recommendations For Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier, update to version 1.50.2 or later, which by default no longer accepts self-signed HTTPS certificates and performs hostname validation. Note that a new configuration option in version 1.50.2 allows restoring the previous, unsafe behavior, so it is recommended to avoid using this option to maintain the secure default settings.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-2187

GHSA-C89C-PVM7-33WJ

Affected Products

Jenkins

Jenkins Amazon Ec2 Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2187 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2187 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1528 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c89c-pvm7-33wj · Vendor Advisory
• https://github.com/jenkinsci/ec2-plugin · Note
• https://github.com/jenkinsci/ec2-plugin/commit/4c9f03ae202e4730fd54eda40771fa4d3873e358 · Note
• http://openwall.com/lists/oss-security/2020/05/06/3 · Note