CVE-2024-28161: Jenkins Delphix Plugin SSL/TLS Certificate Validation Disabled by Default
Summary
CVE-2024-28161: Jenkins Delphix Plugin has SSL/TLS certificate validation disabled by default. Affects org.jenkins-ci.plugins:delphix versions >= 3.0.1, < 3.0.2. Fixed in 3.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Delphix Plugin is a Maven-based package that integrates Jenkins with Data Control Tower (DCT) for managing data virtualization. It provides functionality for administrators to configure and control DCT connections within Jenkins. The plugin allows users to interact with DCT and perform various data management tasks.
Vulnerability Detail
The Jenkins Delphix Plugin version 3.0.1 has SSL/TLS certificate validation disabled by default. This means that when establishing connections with DCT, the plugin does not verify the authenticity of SSL/TLS certificates. This vulnerability exposes users to potential man-in-the-middle attacks, where an attacker can intercept and modify the communication between Jenkins and DCT without detection. The impact of this vulnerability is moderate, as it can lead to unauthorized access, data tampering, and potential compromise of sensitive information.
How To Fix
Minimum fixed version
3.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrade to version 3.0.2 is not possible, a temporary workaround is to manually enable SSL/TLS certificate validation in the plugin configuration. This can be done by accessing the Jenkins Delphix Plugin settings and enabling the option for SSL/TLS certificate validation. However, this workaround is not recommended as it may introduce security risks.
Conclusion
The Jenkins Delphix Plugin version 3.0.1 has a vulnerability that disables SSL/TLS certificate validation by default. This can expose users to man-in-the-middle attacks and unauthorized access. It is recommended to upgrade to version 3.0.2 or later to fix this vulnerability. If immediate upgrade is not possible, manually enabling SSL/TLS certificate validation can be used as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:delphix →
FAQ
The vulnerability exposes users to potential man-in-the-middle attacks, unauthorized access, data tampering, and potential compromise of sensitive information.
Upgrade to Jenkins Delphix Plugin version 3.0.2 or later, where SSL/TLS certificate validation is enabled by default.
Yes, you can manually enable SSL/TLS certificate validation in the plugin configuration. However, this workaround is not recommended as it may introduce security risks.
There are no known exploits for this vulnerability at the time of this advisory.
You can find more information about the Jenkins Delphix Plugin on the official Jenkins website or the plugin's GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:delphix.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
