SSL/TLS certificate validation globally and unconditionally disabled by Jenkins WebSphere Deployer Plugin
Summary
CVE-2019-16561: Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM. Affects org.jenkins-ci.plugins:websphere-deployer versions < 1.6.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins WebSphere Deployer Plugin is a plugin for the Jenkins automation server that allows users to deploy applications to IBM WebSphere Application Server. It provides integration with WebSphere Application Server and simplifies the deployment process. The plugin is widely used in Jenkins environments for deploying applications to WebSphere Application Server instances.
Vulnerability Detail
The Jenkins WebSphere Deployer Plugin version 1.6.1 and earlier has a vulnerability that allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM. This means that the plugin does not verify the authenticity of SSL/TLS certificates when establishing secure connections, making it susceptible to man-in-the-middle attacks. An attacker could exploit this vulnerability to intercept and modify communication between the Jenkins master and WebSphere Application Server, potentially leading to unauthorized access, data leakage, or other security breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of the Jenkins WebSphere Deployer Plugin.
Conclusion
The Jenkins WebSphere Deployer Plugin version 1.6.1 and earlier is vulnerable to SSL/TLS certificate validation being globally and unconditionally disabled. This can lead to security breaches and unauthorized access. It is crucial to upgrade to the latest version of the plugin to fix this vulnerability and ensure the security of your Jenkins environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:websphere-deployer →
FAQ
This vulnerability allows an attacker to intercept and modify communication between the Jenkins master and WebSphere Application Server. It can lead to unauthorized access, data leakage, or other security breaches.
Users of Jenkins WebSphere Deployer Plugin versions 1.6.1 and earlier are affected by this vulnerability.
There is no known exploit for this vulnerability at the time of this advisory. However, it is crucial to apply the recommended fix to mitigate the risk.
There are no known mitigations available for this vulnerability. Upgrading to the latest version of the Jenkins WebSphere Deployer Plugin is the recommended course of action.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins environment is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:websphere-deployer.
