~ / search / GHSA-2h95-4xw9-m68j

GHSA-2h95-4xw9-m68j

Jenkins Active Directory Plugin Improper certificate validation with StartTLS

Source: GitHub Advisory Database (reviewed) High CVE-2019-1003009

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:active-directory < 2.11 2.11

Details

As written in the advisory (Markdown source, shown as plain text).

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.

References

External links from the advisory. They lead to third-party sites.