CVE-2019-10382: Jenkins VMware Lab Manager Slaves Plugin Improper Certificate Validation
Summary
CVE-2019-10382: Jenkins VMware Lab Manager Slaves Plugin vulnerable to Improper Certificate Validation. Affects org.jenkins-ci.plugins:labmanager versions < 0.2.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins VMware Lab Manager Slaves Plugin is a Maven package that provides integration between Jenkins and VMware Lab Manager. It allows Jenkins to manage virtual machine slaves in a VMware Lab Manager environment. This plugin is widely used in continuous integration and deployment workflows to automate the creation and management of virtual machine slaves for testing and building software projects.
Vulnerability Detail
The VMware Lab Manager Slaves Plugin in Jenkins has a vulnerability that results in improper certificate validation. The plugin disables SSL/TLS certificate validation for the entire Jenkins controller JVM, regardless of the validity of the certificates. This means that any SSL/TLS connection made by the plugin will not verify the authenticity of the server's certificate, making it susceptible to man-in-the-middle attacks. An attacker could intercept the communication between the Jenkins controller and the Lab Manager slaves, potentially gaining unauthorized access or tampering with the data exchanged.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by disabling or removing the affected plugin from their Jenkins installation.
Conclusion
The VMware Lab Manager Slaves Plugin in Jenkins is vulnerable to improper certificate validation, which can lead to unauthorized access or data tampering. As of now, there is no fix available for this vulnerability. It is recommended to disable or uninstall the affected plugin until a fix is provided. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:labmanager →
FAQ
The vulnerability allows for the possibility of unauthorized access or tampering with data exchanged between the Jenkins controller and the Lab Manager slaves.
As of the publication of this advisory, there is no fix available for this vulnerability.
Users can mitigate the risk by disabling or removing the affected VMware Lab Manager Slaves Plugin from their Jenkins installation.
There are no known exploits for this vulnerability at the time of this advisory.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-jxg7-cghf-mggx/GHSA-jxg7-cghf-mggx.json
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:labmanager.
