Jenkins Inedo ProGet Plugin SSL/TLS Certificate Validation Bypass
Summary
CVE-2018-1999034: Jenkins Inedo ProGet Plugin globally and unconditionally disabled SSL/TLS certificate validation. Affects com.inedo.proget:inedo-proget versions < 1.0. Fixed in 1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Inedo ProGet Plugin is a Maven package manager that allows users to manage and distribute software packages. It provides functionality for connecting to ProGet, a package repository, and performing various operations. The plugin is widely used in Jenkins environments to streamline the build and deployment processes. However, a vulnerability has been discovered in versions 0.8 and earlier of the plugin, which globally and unconditionally disables SSL/TLS certificate validation. This vulnerability can be exploited by attackers to impersonate any service that Jenkins connects to.
Vulnerability Detail
The vulnerability lies in the ProGetApi.java, ProGetConfig.java, and ProGetConfiguration.java files of the Jenkins Inedo ProGet Plugin. By disabling SSL/TLS certificate validation, the plugin allows for man-in-the-middle attacks. An attacker can intercept the communication between Jenkins and any service it connects to, potentially gaining unauthorized access or manipulating the data exchanged. This can lead to severe security breaches and compromise the integrity and confidentiality of the system.
How To Fix
Minimum fixed version
1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the Jenkins Inedo ProGet Plugin to the latest version as soon as possible.
Conclusion
The Jenkins Inedo ProGet Plugin versions 0.8 and earlier are vulnerable to a SSL/TLS certificate validation bypass. This vulnerability allows attackers to impersonate services connected to Jenkins, potentially leading to unauthorized access and data manipulation. To mitigate this risk, it is crucial to update the plugin to version 1.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.inedo.proget:inedo-proget →
FAQ
This vulnerability allows attackers to impersonate any service that Jenkins connects to, potentially gaining unauthorized access or manipulating the data exchanged.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Yes, updating the Jenkins Inedo ProGet Plugin to version 1.0 or later will fix this vulnerability.
No, there are no known workarounds for this vulnerability. Updating the plugin to the latest version is the recommended solution.
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.inedo.proget:inedo-proget.
