~ / search / GHSA-345p-pw5q-g98v

GHSA-345p-pw5q-g98v

Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-16546

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:google-compute-engine < 4.2.0 4.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks. Google Compute Engine Plugin 4.2.0 verifies SSH host keys before executing any commands on agents.

References

External links from the advisory. They lead to third-party sites.