Medium · 6.8 CVE-2019-16546 EUVD-2022-2102GHSA-345p-pw5q-g98v

Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin

Published Nov 21, 2019 · Updated Aug 5, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Google Compute Engine Plugin Package: org.jenkins-ci.plugins:google-compute-engine Category: Web / CMS Ecosystem: Maven

Description

Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Google Compute Engine Plugin	4.1.1 and earlier	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:google-compute-engine	< 4.2.0	4.2.0	GHSA-345p-pw5q-g98v

References

https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1584
[oss-security] 20191121 Multiple vulnerabilities in Jenkins plugins mailing-list