Skip to content
OpenAdvisories
Medium · 5.6 CVE-2020-2185 EUVD-2022-4923GHSA-q8qq-2p5p-rg44

Missing SSH host key validation in Jenkins Amazon EC2 Plugin

Published May 6, 2020 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Amazon EC2 Plugin Package: org.jenkins-ci.plugins:ec2 Category: Web / CMS Ecosystem: Maven

Description

Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Amazon EC2 Plugin unspecified – ≤ 1.50.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:ec2 < 1.50.2 1.50.2 GHSA-q8qq-2p5p-rg44

References