~ / search / GHSA-hrr3-7r5v-vxx5

GHSA-hrr3-7r5v-vxx5

Jenkins Inedo BuildMaster Plugin globally and unconditionally disabled SSL/TLS certificate validation

Source: GitHub Advisory Database (reviewed) High CVE-2018-1999035

Packages

EcosystemPackageAffectedFixed in
Maven com.inedo.buildmaster:inedo-buildmaster < 2.0 2.0

Details

As written in the advisory (Markdown source, shown as plain text).

A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMasterApi.java that allows attackers to impersonate any service that Jenkins connects to.

References

External links from the advisory. They lead to third-party sites.