PT-2022-27493 · Jenkins · Jenkins Ns-Nd Integration Performance Publisher Plugin+1

Daniel Beck · Published 2022-11-15 · Updated 2023-11-01 · CVE-2022-45391

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins NS-ND Integration Performance Publisher Plugin versions 4.8.0.143 and earlier

Description The issue concerns the global and unconditional disabling of SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM. This affects the security of the system by not verifying the identity of the servers it connects to, potentially allowing man-in-the-middle attacks.

Recommendations For versions 4.8.0.143 and earlier, update to version 4.8.0.146 or later, which no longer disables SSL/TLS certificate and hostname validation globally.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-45391

GHSA-3VWM-FC87-MQ6H

Affected Products

Jenkins

Jenkins Ns-Nd Integration Performance Publisher Plugin

References · 9

• https://jenkins.io/security/advisory/2022-11-15/#SECURITY-2910%20%281%29 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45391 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45391 · Security Note
• https://osv.dev/vulnerability/GHSA-3vwm-fc87-mq6h · Vendor Advisory
• https://github.com/jenkinsci/cavisson-ns-nd-integration-plugin · Note
• https://t.me/cvenotify/37783 · Telegram Post
• https://jenkins.io/security/advisory/2022-11-15/#SECURITY-2910%20(1) · Note
• http://openwall.com/lists/oss-security/2022/11/15/4 · Note
• https://t.me/cvenotify/38021 · Telegram Post