CVE-2020-2253 - Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server

MEDIUM

Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server

Published Sep 16, 2020

4.8

MEDIUM

CVSS 3.1

EPSS 0.69%

Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins project	Jenkins Email Extension Plugin	unknown	Affected ≥ unspecified, ≤ 2.75 Unaffected 2.68.1 2.69.1

No remediation recorded yet.

Weaknesses (1)

CWE-295

Improper Certificate Validation

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2020/09/16/3		mailing-listx_refsource_MLISTThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2432		Advisory
https://github.com/advisories/GHSA-4qrj-99r6-jfrh		Advisory
https://github.com/jenkinsci/email-ext-plugin/commit/ac039ba581f5946975a327709ff201b459900caa
https://nvd.nist.gov/vuln/detail/CVE-2020-2253
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1851		x_refsource_CONFIRMVendor Advisory