CVE-2019-10446: Jenkins Cadence vManager Plugin SSL/TLS and Hostname Verification Bypass
Summary
CVE-2019-10446: Jenkins Cadence vManager Plugin disables SSL/TLS and hostname verification. Affects org.jenkins-ci.plugins:vmanager-plugin versions < 2.7.1. Fixed in 2.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Cadence vManager Plugin is a Maven package that provides functionality for managing vManager instances in a Jenkins environment. It allows users to interact with vManager, a tool for managing and orchestrating virtual machines. The plugin integrates with Jenkins to automate tasks related to virtual machine management. However, prior to version 2.7.1, the plugin had a vulnerability that disabled SSL/TLS and hostname verification globally for the Jenkins master JVM.
Vulnerability Detail
The vulnerability in the Jenkins Cadence vManager Plugin allows an attacker to bypass SSL/TLS and hostname verification. This means that communication between the Jenkins master JVM and vManager instances can be intercepted or modified by an attacker without detection. This can lead to various security risks, such as man-in-the-middle attacks, data tampering, and unauthorized access to sensitive information. The vulnerability is rated as HIGH severity with a CVSS score of 8.2.
How To Fix
Minimum fixed version
2.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the plugin to the latest version to mitigate the risk.
Conclusion
The Jenkins Cadence vManager Plugin prior to version 2.7.1 has a vulnerability that disables SSL/TLS and hostname verification, exposing the communication between the Jenkins master JVM and vManager instances to potential attacks. To mitigate this risk, it is crucial to update the plugin to version 2.7.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:vmanager-plugin →
FAQ
The vulnerability allows an attacker to intercept or modify communication between the Jenkins master JVM and vManager instances, potentially leading to security breaches, data tampering, and unauthorized access.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, upgrading the Jenkins Cadence vManager Plugin to version 2.7.1 or later fixes the vulnerability by enabling SSL/TLS and hostname verification.
No, there are no known workarounds for this vulnerability. Updating the plugin is the recommended solution.
The vulnerability is rated as HIGH severity with a CVSS score of 8.2.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:vmanager-plugin.
