High · 7.4 CVE-2018-1999035 EUVD-2022-4212GHSA-hrr3-7r5v-vxx5

Jenkins Inedo BuildMaster Plugin globally and unconditionally disabled SSL/TLS certificate validation

Published Aug 1, 2018 · Updated Sep 17, 2024 · Assigned by mitre

Package: com.inedo.buildmaster:inedo-buildmaster Ecosystem: Maven

Description

A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMasterApi.java that allows attackers to impersonate any service that Jenkins connects to.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	com.inedo.buildmaster:inedo-buildmaster	< 2.0	2.0	GHSA-hrr3-7r5v-vxx5

References

https://jenkins.io/security/advisory/2018-07-30/#SECURITY-935