~ / search / GHSA-vq7p-f4fv-rr5x

GHSA-vq7p-f4fv-rr5x

Jenkins vSphere Plugin disables SSL/TLS certificate validation by default

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000151

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:vsphere-cloud < 2.17 2.17

Details

As written in the advisory (Markdown source, shown as plain text).

A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default. vSphere Plugin 2.17 now has SSL/TLS certificate validation enabled by default.

References

External links from the advisory. They lead to third-party sites.