Jenkins SSH Build Agents Plugin did not verify host keys

2022-05-1301:36:51

Google

osv.dev

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.0%

JSON

It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks.

CPENameOperatorVersion
org.jenkins-ci.plugins:ssh-slaveseq1.5
org.jenkins-ci.plugins:ssh-slaveseq1.10
org.jenkins-ci.plugins:ssh-slaveseq0.23
org.jenkins-ci.plugins:ssh-slaveseq1.13
org.jenkins-ci.plugins:ssh-slaveseq1.1
org.jenkins-ci.plugins:ssh-slaveseq1.0
org.jenkins-ci.plugins:ssh-slaveseq1.11
org.jenkins-ci.plugins:ssh-slaveseq0.15
org.jenkins-ci.plugins:ssh-slaveseq1.3
org.jenkins-ci.plugins:ssh-slaveseq0.21

Name	Operator	Version
org.jenkins-ci.plugins:ssh-slaves	eq	1.5
org.jenkins-ci.plugins:ssh-slaves	eq	1.10
org.jenkins-ci.plugins:ssh-slaves	eq	0.23
org.jenkins-ci.plugins:ssh-slaves	eq	1.13
org.jenkins-ci.plugins:ssh-slaves	eq	1.1
org.jenkins-ci.plugins:ssh-slaves	eq	1.0
org.jenkins-ci.plugins:ssh-slaves	eq	1.11
org.jenkins-ci.plugins:ssh-slaves	eq	0.15
org.jenkins-ci.plugins:ssh-slaves	eq	1.3
org.jenkins-ci.plugins:ssh-slaves	eq	0.21