CVE-2017-2648

2018-07-2720:29:00

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.0%

JSON

It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks.

CPENameOperatorVersion
ssh-slaves-plugineqssh-slaves-1.14
ssh-slaves-plugineqssh-slaves-1.7.1
ssh-slaves-plugineqssh-slaves-0.27
ssh-slaves-plugineqssh-slaves-0.21
ssh-slaves-plugineqssh-slaves-0.23
ssh-slaves-plugineqssh-slaves-1.10
ssh-slaves-plugineqssh-slaves-0.22
ssh-slaves-plugineqssh-slaves-0.17
ssh-slaves-plugineqssh-slaves-1.9
ssh-slaves-plugineqssh-slaves-1.7

Name	Operator	Version
ssh-slaves-plugin	eq	ssh-slaves-1.14
ssh-slaves-plugin	eq	ssh-slaves-1.7.1
ssh-slaves-plugin	eq	ssh-slaves-0.27
ssh-slaves-plugin	eq	ssh-slaves-0.21
ssh-slaves-plugin	eq	ssh-slaves-0.23
ssh-slaves-plugin	eq	ssh-slaves-1.10
ssh-slaves-plugin	eq	ssh-slaves-0.22
ssh-slaves-plugin	eq	ssh-slaves-0.17
ssh-slaves-plugin	eq	ssh-slaves-1.9
ssh-slaves-plugin	eq	ssh-slaves-1.7