CVE-2020-2185
published 2020-05-06CVE-2020-2185: Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks.
PriorityP425medium5.6CVSS 3.1
AVNACHPRNUINSUCLILAL
EPSS
0.69%
48.7th percentile
Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | amazon_ec2 | <= 1.50.1 | — |
| jenkins | amazon_ec2_plugin | — | — |
| jenkins | copy_artifact_plugin | — | — |
| jenkins | credentials_binding_plugin | — | — |
| jenkins | cvs_plugin | — | — |
| jenkins | for_more_information_see_the_plugin | — | — |
| jenkins | ids_in_amazon_ec2_plugin | — | — |
| jenkins | ids_to_allow_users_configuring_the_plugin | — | — |
| jenkins | scm_filter_jervis_plugin | — | — |
| jenkins | when_updating_the_plugin | — | — |
| jenkins_project | jenkins_amazon_ec2_plugin | unspecified – 1.50.1 | — |
CVSS provenance
nvdv3.15.6MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Missing SSH host key validation in Jenkins Amazon EC2 Plugin
ghsa·2022-05-24
CVE-2020-2185 [MEDIUM] CWE-300 Missing SSH host key validation in Jenkins Amazon EC2 Plugin
Missing SSH host key validation in Jenkins Amazon EC2 Plugin
Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not use SSH host key validation when connecting to agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents.
Jenkins Amazon EC2 Plugin 1.50.2 provides strategies for performing host key validation for administrators to select the one that meets their security needs. It includes assistance for administrators to migrate to a new, more secure strategy. For more information see [the plugin documentation](https://github.com/jenkinsci/ec2-plugin/#securing-the-connection-to-unix-amis).
OSV
Missing SSH host key validation in Jenkins Amazon EC2 Plugin
osv·2022-05-24
CVE-2020-2185 [MEDIUM] Missing SSH host key validation in Jenkins Amazon EC2 Plugin
Missing SSH host key validation in Jenkins Amazon EC2 Plugin
Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not use SSH host key validation when connecting to agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents.
Jenkins Amazon EC2 Plugin 1.50.2 provides strategies for performing host key validation for administrators to select the one that meets their security needs. It includes assistance for administrators to migrate to a new, more secure strategy. For more information see [the plugin documentation](https://github.com/jenkinsci/ec2-plugin/#securing-the-connection-to-unix-amis).
Jenkins
Jenkins Security Advisory 2020-05-06
vendor_jenkins·2020-05-06·CVSS 6.5
CVE-2020-2181 [MEDIUM] Jenkins Security Advisory 2020-05-06
Title: Jenkins Security Advisory 2020-05-06
Jenkins Security Advisory 2020-05-06
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Amazon EC2
Plugin
Copy Artifact
Plugin
Credentials Binding
Plugin
CVS
Plugin
SCM Filter Jervis
Plugin
Descriptions
Secrets are not masked by Credentials Binding Plugin in
Red Hat
kernel: infinite loop in set_memory_region_test in arch/x86/kvm/svm/svm.c for certain nested page faults
vendor_redhat·2020-04-21·CVSS 5.5
CVE-2020-36310 [MEDIUM] CWE-835 kernel: infinite loop in set_memory_region_test in arch/x86/kvm/svm/svm.c for certain nested page faults
kernel: infinite loop in set_memory_region_test in arch/x86/kvm/svm/svm.c for certain nested page faults
An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a set_memory_region_test infinite loop for certain nested page faults, aka CID-e72436bc3a52.
A flaw was found in the Linux kernel. A nested page fault is created when an address does not have a memslot associated to it. The highest threat from this vulnerability is to system availability. This flaw can be triggered using a malformed Virtual Machine. When triggered this bug will lead to the user-space component of KVM to freeze.
Statement: Red Hat Product Security does not consider this to be a vulnerability. This issue has addressed as a regular bug in the errata RHSA-2021:2185 and RHSA-2021:1578. T
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-05-06
Published