PT-2023-3634 · Jenkins · Jenkins Checkmarx Plugin+1

Daniel Beck · Published 2023-06-14 · Updated 2025-01-02 · CVE-2023-35142

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Checkmarx Plugin versions 2022.4.3 and earlier

Description The issue is related to errors in SSL/TLS certificate validation. It may allow a remote attacker to perform a "man-in-the-middle" attack. The plugin disables SSL/TLS validation for connections to the Checkmarx server by default.

Recommendations For Jenkins Checkmarx Plugin versions 2022.4.3 and earlier, consider enabling SSL/TLS validation for connections to the Checkmarx server to prevent potential "man-in-the-middle" attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2023-03918

CVE-2023-35142

GHSA-RR3P-5FCF-V5M3

Affected Products

Jenkins

Jenkins Checkmarx Plugin

References · 9

• https://osv.dev/vulnerability/CVE-2023-35142 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rr3p-5fcf-v5m3 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03918 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-35142 · Security Note
• https://jenkins.io/security/advisory/2023-06-14/#SECURITY-2870 · Vendor Advisory
• https://openwall.com/lists/oss-security/2023/06/14/5 · Note
• https://t.me/cvenotify/106083 · Telegram Post
• https://vuldb.com/ru/?id.231534 · Note
• http://openwall.com/lists/oss-security/2023/06/14/5 · Note