Lucene search

GitHub Advisory DatabaseGHSA-3VWM-FC87-MQ6H

HistoryNov 16, 2022 - 12:00 p.m.

Jenkins NS-ND Integration Performance Publisher Plugin disables SSL/TLS certificate validation globally and unconditionally

2022-11-1612:00:23

CWE-295

GitHub Advisory Database

github.com

jenkins

performance plugin

ssl/tls

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

34.4%

JSON

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM.

NS-ND Integration Performance Publisher Plugin 4.8.0.146 no longer disables SSL/TLS certificate and hostname validation globally.

Affected configurations

Vulners

Node

jenkinsns-nd_integration_performance_publisherRange<4.8.0.146jenkins

CPENameOperatorVersion
io.jenkins.plugins:cavisson-ns-nd-integrationlt4.8.0.146

CPE	Name	Operator	Version
	io.jenkins.plugins:cavisson-ns-nd-integration	lt	4.8.0.146

References

www.openwall.com/lists/oss-security/2022/11/15/4

github.com/advisories/GHSA-3vwm-fc87-mq6h

nvd.nist.gov/vuln/detail/CVE-2022-45391

www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2910%20%281%29

www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2910%20(1)

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

34.4%

JSON

Related for GHSA-3VWM-FC87-MQ6H