CVE-2019-16546 - Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks

Back Back to CVE browser

MEDIUM

Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks

Published Nov 21, 2019

5.9

MEDIUM

CVSS 3.1

EPSS 0.87%

Description

Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.

Affected products

Vendor Jenkins project Product Jenkins Google Compute Engine Plugin Default
n/a
- Version
  4.1.1 and earlier
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins Google Compute Engine Plugin

n/a

Version	Status	Constraints
4.1.1 and earlier	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-300

CWE-639

Authorization Bypass

References (5)

http://www.openwall.com/lists/oss-security/2019/11/21/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2102
Advisory
https://github.com/advisories/GHSA-345p-pw5q-g98v
Advisory
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1584
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16546

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/11/21/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2102		Advisory
https://github.com/advisories/GHSA-345p-pw5q-g98v		Advisory
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1584		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16546