CVE-2022-45391: SSL/TLS certificate validation globally and unconditionally disabled by Jenkins NS-ND Integration Performance Publisher Plugin
Summary
CVE-2022-45391: Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM. Affects io.jenkins.plugins:cavisson-ns-nd-integration versions < 4.8.0.146. Fixed in 4.8.0.146. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins NS-ND Integration Performance Publisher Plugin is a Maven package (io.jenkins.plugins:cavisson-ns-nd-integration) that provides integration with the NS-ND Integration Performance tool. This plugin allows users to publish performance metrics from Jenkins to the NS-ND Integration Performance tool for analysis and monitoring. The plugin is widely used in Jenkins environments for performance testing and monitoring purposes.
Vulnerability Detail
The NS-ND Integration Performance Publisher Plugin version 4.8.0.143 and earlier has a vulnerability that globally and unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM. This means that any SSL/TLS connections made by the plugin will not verify the authenticity of the server's certificate or validate the hostname, making it susceptible to man-in-the-middle attacks. An attacker could potentially intercept and modify the communication between the plugin and the NS-ND Integration Performance tool, leading to data tampering, unauthorized access, or other security breaches.
How To Fix
Minimum fixed version
4.8.0.146
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version of the plugin as soon as possible.
Conclusion
The Jenkins NS-ND Integration Performance Publisher Plugin version 4.8.0.143 and earlier has a vulnerability that disables SSL/TLS certificate and hostname validation globally. This can lead to security breaches and unauthorized access. It is strongly recommended to upgrade to version 4.8.0.146 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:cavisson-ns-nd-integration →
FAQ
This vulnerability allows an attacker to intercept and modify the communication between the NS-ND Integration Performance Publisher Plugin and the NS-ND Integration Performance tool. This can lead to data tampering, unauthorized access, or other security breaches.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins environment is affected by this vulnerability. Simply enter your pom.xml file and the playground will analyze it for open-source vulnerabilities, including this one.
There are currently no known exploits for this vulnerability. However, it is important to upgrade to the fixed version of the plugin to ensure the security of your Jenkins environment.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version of the plugin is the only way to mitigate the risk.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-3vwm-fc87-mq6h/GHSA-3vwm-fc87-mq6h.json
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:cavisson-ns-nd-integration.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
