~ / search / GHSA-7jwg-hq85-c6m6

GHSA-7jwg-hq85-c6m6

Jenkins SmallTest Plugin missing hostname validation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-41243

Packages

EcosystemPackageAffectedFixed in
Maven com.smalltest:smalltest <= 1.0.4 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections. There is currently no known workaround or fix for this issue.

References

External links from the advisory. They lead to third-party sites.