PT-2022-18841 · Jenkins · Jenkins Proxmox Plugin+1

Daniel Beck · Published 2022-03-29 · Updated 2023-11-17 · CVE-2022-28142

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Proxmox Plugin versions 0.6.0 and earlier

Description The issue concerns the disabling of SSL/TLS certificate validation globally for the Jenkins controller JVM when the plugin is configured to ignore SSL/TLS issues. This affects the security of the system by potentially allowing unauthorized access or malicious activity.

Recommendations For Jenkins Proxmox Plugin versions 0.6.0 and earlier, consider disabling the plugin until a patched version is available to prevent the global disabling of SSL/TLS certificate validation. As a temporary workaround, avoid configuring the plugin to ignore SSL/TLS issues to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-28142

GHSA-FHHX-R983-44XC

Affected Products

Jenkins

Jenkins Proxmox Plugin

References · 10

• https://jenkins.io/security/advisory/2022-03-29/#SECURITY-2081 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28142 · Security Note
• https://osv.dev/vulnerability/GHSA-fhhx-r983-44xc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28142 · Vendor Advisory
• https://github.com/jenkinsci/proxmox-plugin · Note
• https://t.me/cvenotify/60609 · Telegram Post
• https://t.me/cvenotify/60604 · Telegram Post
• https://t.me/cvenotify/60608 · Telegram Post
• http://openwall.com/lists/oss-security/2022/03/29/1 · Note
• https://t.me/cibsecurity/39734 · Telegram Post