CVE-2023-30516: Jenkins Image Tag Parameter Plugin SSL/TLS Certificate Validation Bypass
Summary
CVE-2023-30516: Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries. Affects org.jenkins-ci.plugins:image-tag-parameter versions < 2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Image Tag Parameter Plugin is a Maven package that allows users to define image tags as parameters in Jenkins jobs. It provides flexibility in specifying image tags for Docker containers used in the CI/CD pipeline. The plugin is widely used in Jenkins environments for managing Docker images and containers.
Vulnerability Detail
The Jenkins Image Tag Parameter Plugin version 2.0 introduces a new option that allows users to disable SSL/TLS certificate validation when connecting to Docker registries. This means that SSL/TLS certificates presented by the registries are not verified, potentially exposing the connection to man-in-the-middle attacks.
Job configurations created before version 2.0 will have SSL/TLS certificate validation disabled by default, further increasing the risk of insecure connections.
This vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually enable SSL/TLS certificate validation for Docker registry connections by modifying the job configurations. This can be done by explicitly setting the SSL/TLS certificate validation option to 'true' in the Image Tag Parameter settings.
Example:
{
"imageTagParameter": {
"disableSslVerification": false
}
}
Conclusion
The Jenkins Image Tag Parameter Plugin version 2.0 introduces a vulnerability that allows users to disable SSL/TLS certificate validation for Docker registry connections. This can potentially expose the communication to man-in-the-middle attacks and compromise the security of the CI/CD pipeline. It is crucial to update to a fixed version of the plugin and enable SSL/TLS certificate validation to mitigate this vulnerability. For additional support, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:image-tag-parameter →
FAQ
This vulnerability allows an attacker to potentially intercept and manipulate the communication between Jenkins and Docker registries. It can lead to unauthorized access, data leakage, or the deployment of malicious Docker images.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins environment is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any vulnerable dependencies.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fix to mitigate any potential risks.
While it is possible to disable SSL/TLS certificate validation for Docker registry connections, it is strongly discouraged as it increases the risk of man-in-the-middle attacks and compromises the security of the communication.
For further support and assistance with vulnerability remediation, you can reach out to info@devnack.com. Our team of experts will be happy to assist you.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:image-tag-parameter.
