CVE-2020-2146
published 2020-03-09CVE-2020-2146: Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.
PriorityP434high7.4CVSS 3.1
AVNACHPRNUINSUCHIHAN
EPSS
0.57%
46.5th percentile
Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | audit_trail_plugin | — | — |
| jenkins | backlog_plugin | — | — |
| jenkins | chaos_monkey_plugin | — | — |
| jenkins | cobertura_plugin | — | — |
| jenkins | credentials_plugin | — | — |
| jenkins | cryptomove_plugin | — | — |
| jenkins | cvs_plugin | — | — |
| jenkins | deployhub_plugin | — | — |
| jenkins | docker_images_of_jenkins_2.269_and_2.263.1_contain_plugin | — | — |
| jenkins | git_plugin | — | — |
| jenkins | installation_manager_tool_did_not_verify_plugin | — | — |
| jenkins | jenkins_is_running_plugin | — | — |
| jenkins | literate_plugin | — | — |
| jenkins | logstash_plugin | — | — |
| jenkins | mac | <= 1.1.0 | — |
| jenkins | mac_cloud_host_launched_by_the_plugin | — | — |
| jenkins | mac_plugin | — | — |
| jenkins | manager_tool_2.1.3_and_earlier_does_not_verify_plugin | — | — |
| jenkins | openshift_deployer_plugin | — | — |
| jenkins | p4_plugin | — | — |
| jenkins | quality_gates_plugin | — | — |
| jenkins | repository_connector_plugin | — | — |
| jenkins | rundeck_plugin | — | — |
| jenkins | sandbox_protection_in_script_security_plugin | — | — |
| jenkins | script_security_plugin | — | — |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Missing SSH host key validation in Mac Plugin
osv·2022-05-24
CVE-2020-2146 [MEDIUM] Missing SSH host key validation in Mac Plugin
Missing SSH host key validation in Mac Plugin
Mac Plugin 1.1.0 and earlier does not use SSH host key validation when connecting to Mac Cloud host launched by the plugin. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents.
Mac Plugin 1.2.0 validates SSH host keys when connecting to agents.
GHSA
Missing SSH host key validation in Mac Plugin
ghsa·2022-05-24
CVE-2020-2146 [MEDIUM] CWE-347 Missing SSH host key validation in Mac Plugin
Missing SSH host key validation in Mac Plugin
Mac Plugin 1.1.0 and earlier does not use SSH host key validation when connecting to Mac Cloud host launched by the plugin. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents.
Mac Plugin 1.2.0 validates SSH host keys when connecting to agents.
Jenkins
Jenkins Security Advisory 2020-03-09
vendor_jenkins·2020-03-09·CVSS 8.8
CVE-2020-2134 [HIGH] Jenkins Security Advisory 2020-03-09
Title: Jenkins Security Advisory 2020-03-09
Jenkins Security Advisory 2020-03-09
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Audit Trail
Plugin
Backlog
Plugin
Cobertura
Plugin
CryptoMove
Plugin
DeployHub
Plugin
Git
Plugin
Literate
Plugin
Logstash
Plugin
Mac
Plugin
OpenShift Deploy
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-03-09
Published