CVE-2020-2253: Missing hostname validation in Email Extension Plugin
Summary
CVE-2020-2253: Missing hostname validation in Email Extension Plugin. Affects org.jenkins-ci.plugins:email-ext versions < 2.76. Fixed in 2.76. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Email Extension Plugin is a plugin for Jenkins, an open-source automation server. It allows users to extend the functionality of Jenkins by adding email notifications to build results. The plugin integrates with the Simple Mail Transfer Protocol (SMTP) server to send emails. However, versions 2.75 and earlier of the Email Extension Plugin do not perform hostname validation when connecting to the configured SMTP server.
Vulnerability Detail
The missing hostname validation in the Email Extension Plugin can be exploited through a man-in-the-middle attack. An attacker could intercept the connections between the plugin and the SMTP server, potentially gaining unauthorized access to sensitive information or modifying the content of the emails. This vulnerability poses a moderate risk to the security of Jenkins instances using affected versions of the plugin.
How To Fix
Minimum fixed version
2.76
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading or modifying the plugin configuration is not immediately feasible, administrators can set the 'mail.smtp.ssl.checkserveridentity' Java system property to 'true' manually. This can be done by adding the following line to the Jenkins startup script:
-Dmail.smtp.ssl.checkserveridentity=true
Conclusion
The missing hostname validation vulnerability in the Email Extension Plugin can be mitigated by upgrading to version 2.76 or later, enabling hostname validation through configuration, or manually setting the 'mail.smtp.ssl.checkserveridentity' Java system property. It is important to take action to protect the security and integrity of email communications in Jenkins instances. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:email-ext →
FAQ
This vulnerability allows an attacker to intercept connections between the Email Extension Plugin and the SMTP server, potentially compromising the confidentiality and integrity of email communications.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities, including this one.
While it is not recommended, administrators can disable hostname validation by setting the 'mail.smtp.ssl.checkserveridentity' Java system property to 'false'. However, this increases the risk of man-in-the-middle attacks.
Yes, besides upgrading to version 2.76 or later, administrators can enable hostname validation through the 'Advanced Email Properties' field in the plugin's configuration in Configure System.
Yes, administrators can manually set the 'mail.smtp.ssl.checkserveridentity' Java system property to 'true' as a temporary workaround until the plugin can be upgraded or reconfigured.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:email-ext.
