CVE-2020-2252: Improper Validation of Certificate with Host Mismatch in Jenkins Mailer Plugin
Summary
CVE-2020-2252: Improper Validation of Certificate with Host Mismatch in Jenkins Mailer Plugin. Affects org.jenkins-ci.plugins:mailer across 3 version ranges.
< 1.29.1
>= 1.30, < 1.31.1
>= 1.32, < 1.32.1
Fixed in 1.29.1, 1.31.1 or 1.32.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Mailer Plugin is a Maven package that provides email notification functionality for the Jenkins automation server. It allows users to configure SMTP servers for sending email notifications. This plugin is widely used in Jenkins installations to send email notifications for build results, job status, and other events.
Vulnerability Detail
The Jenkins Mailer Plugin prior to versions 1.32.1, 1.31.1, and 1.29.1 does not perform hostname validation when connecting to the configured SMTP server. This lack of validation opens up the possibility of a man-in-the-middle attack, where an attacker can intercept the connections between Jenkins and the SMTP server. By intercepting these connections, an attacker can potentially access sensitive information or modify the email content being sent by Jenkins.
How To Fix
Latest published version: 534.v1b_36f5864073 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.29.11.29.1 -
>= 1.30, < 1.31.11.31.1 -
>= 1.32, < 1.32.11.32.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Jenkins Mailer Plugin prior to versions 1.32.1, 1.31.1, and 1.29.1 is vulnerable to an improper validation of certificates with host mismatch. This can be exploited by attackers to intercept connections and potentially access or modify email content. It is recommended to upgrade to the fixed versions or enable hostname validation to mitigate this vulnerability. For further support, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:mailer →
FAQ
This vulnerability allows an attacker to intercept connections between Jenkins and the SMTP server, potentially accessing sensitive information or modifying email content.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file and Vulert will analyze it for open-source vulnerabilities, including this one.
There are no known exploits for this vulnerability at the moment. However, it is recommended to apply the necessary fixes to mitigate the risk.
While it is possible to disable hostname validation by setting the Java system property 'mail.smtp.ssl.checkserveridentity' to false on startup, it is not recommended. Enabling hostname validation provides an important security measure against man-in-the-middle attacks.
For further support on vulnerability remediation and assistance in securing your Jenkins installation, you can contact info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:mailer.
