CVE-2024-28162: Jenkins Delphix Plugin SSL/TLS Certificate Validation Vulnerability
Summary
CVE-2024-28162: Jenkins Delphix Plugin has improper SSL/TLS certificate validation. Affects org.jenkins-ci.plugins:delphix versions >= 3.0.1, < 3.1.1. Fixed in 3.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Delphix Plugin is a Maven-based plugin that integrates Jenkins with Delphix, a data management platform. It allows users to automate data operations and provisioning tasks within their Jenkins pipelines. The plugin provides functionality for connecting to the Data Control Tower (DCT) using SSL/TLS encryption.
Vulnerability Detail
The Jenkins Delphix Plugin versions 3.0.1 through 3.1.0 suffer from an SSL/TLS certificate validation vulnerability. The plugin includes a global option to enable or disable SSL/TLS certificate validation for DCT connections. However, when switching from disabled validation to enabled validation, the change does not take effect until Jenkins is restarted. This means that even if administrators enable certificate validation, it remains ineffective until a Jenkins restart is performed.
How To Fix
Minimum fixed version
3.1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users must upgrade to the fixed version of the Jenkins Delphix Plugin to address the SSL/TLS certificate validation issue.
Conclusion
The Jenkins Delphix Plugin versions 3.0.1 through 3.1.0 are vulnerable to an SSL/TLS certificate validation issue. To mitigate this vulnerability, users should upgrade to version 3.1.1 or later. No known workarounds exist for this issue. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:delphix →
FAQ
This vulnerability allows an attacker to bypass SSL/TLS certificate validation for DCT connections in Jenkins Delphix Plugin. It could potentially lead to man-in-the-middle attacks and unauthorized access to sensitive data.
Yes, this vulnerability can be exploited remotely by an attacker who can establish a connection to the affected Jenkins instance.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory.
While disabling SSL/TLS certificate validation may temporarily mitigate the risk, it is not recommended as a long-term solution. Enabling certificate validation and upgrading to the fixed version of the Jenkins Delphix Plugin is the recommended approach.
No, upgrading to the fixed version of the Jenkins Delphix Plugin should address the SSL/TLS certificate validation vulnerability without requiring any additional configuration.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:delphix.
