Jenkins Codefresh Integration Plugin Improper Certificate Validation vulnerability

2022-05-2416:52:45

Google

osv.dev

0.002 Low

EPSS

Percentile

55.2%

JSON

Codefresh Integration Plugin unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM.

As of publication of this advisory, there is no fix.

CPENameOperatorVersion
org.jenkins-ci.plugins:codefresheq1.2
org.jenkins-ci.plugins:codefresheq1.7
org.jenkins-ci.plugins:codefresheq1.4
org.jenkins-ci.plugins:codefresheq1.5
org.jenkins-ci.plugins:codefresheq1.0
org.jenkins-ci.plugins:codefresheq1.1
org.jenkins-ci.plugins:codefresheq1.6
org.jenkins-ci.plugins:codefresheq1.3
org.jenkins-ci.plugins:codefresheq1.8

Name	Operator	Version
org.jenkins-ci.plugins:codefresh	eq	1.2
org.jenkins-ci.plugins:codefresh	eq	1.7
org.jenkins-ci.plugins:codefresh	eq	1.4
org.jenkins-ci.plugins:codefresh	eq	1.5
org.jenkins-ci.plugins:codefresh	eq	1.0
org.jenkins-ci.plugins:codefresh	eq	1.1
org.jenkins-ci.plugins:codefresh	eq	1.6
org.jenkins-ci.plugins:codefresh	eq	1.3
org.jenkins-ci.plugins:codefresh	eq	1.8