GHSA-cm7j-p8hc-97vj

Jenkins Git client plugin 3.11.0 does not perform SSH host key verification

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-36881

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:git-client	< 3.11.1	3.11.1

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Git client plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Git client Plugin 3.11.1 provides strategies for performing host key verification for administrators to select the one that meets their security needs. For more information see [the plugin documentation](https://github.com/jenkinsci/git-client-plugin#ssh-host-key-verification).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-36881 advisory
https://github.com/jenkinsci/git-client-plugin/commit/88f52c6c9b18bca4ad210e3b9910a49433583fd9 web
https://github.com/jenkinsci/git-client-plugin package
https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468 web
http://www.openwall.com/lists/oss-security/2022/07/27/1 web