MEDIUM 4.8 Maven
Jenkins Git client plugin 3.11.0 does not perform SSH host key verification
GHSA-cm7j-p8hc-97vj · CVE-2022-36881
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Jenkins Git client plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Git client Plugin 3.11.1 provides strategies for performing host key verification for administrators to select the one that meets their security needs. For more information see the plugin documentation.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-36881
- WEB https://github.com/jenkinsci/git-client-plugin/commit/88f52c6c9b18bca4ad210e3b9910a49433583fd9
- PACKAGE https://github.com/jenkinsci/git-client-plugin
- WEB https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468
- WEB http://www.openwall.com/lists/oss-security/2022/07/27/1
Ready to move
Start Securing
Free, no credit card | First findings in minutes