PT-2022-5835 · Jenkins · Jenkins Git Client Plugin+1

Alex Kurtser + 1 · Published 2022-07-27 · Updated 2023-11-22 · CVE-2022-36881

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Git client Plugin versions 3.11.0 and earlier

Description The issue is related to the lack of SSH host key verification when connecting to Git repositories via SSH, which enables man-in-the-middle attacks. This is due to shortcomings in the authentication procedure. The exploitation of this issue can allow a remote attacker to implement a man-in-the-middle attack.

Recommendations For Jenkins Git client Plugin versions 3.11.0 and earlier, update to version 3.11.1 or later, which provides strategies for performing host key verification, allowing administrators to select the one that meets their security needs.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-322

CWE-295

Related Identifiers

BDU:2022-07248

CVE-2022-36881

GHSA-CM7J-P8HC-97VJ

RHSA-2022:7865

RHSA-2023:0017

Affected Products

Jenkins

Jenkins Git Client Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-36881 · Security Note
• https://jenkins.io/security/advisory/2022-07-27/#SECURITY-1468 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36881 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07248 · Security Note
• https://osv.dev/vulnerability/GHSA-cm7j-p8hc-97vj · Vendor Advisory
• https://github.com/jenkinsci/git-client-plugin · Note
• https://github.com/jenkinsci/git-client-plugin/commit/88f52c6c9b18bca4ad210e3b9910a49433583fd9 · Note
• https://jenkins.io/security/advisory/2022-07-27/#SECURITY-284 · Note
• https://vuldb.com/ru/?id.205163 · Note
• http://openwall.com/lists/oss-security/2022/07/27/1 · Note