212 matches found
jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client
A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks...
CVE-2022-36881
A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks...
GHSA-CM7J-P8HC-97VJ Jenkins Git client plugin 3.11.0 does not perform SSH host key verification
Jenkins Git client plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Git client Plugin 3.11.1 provides strategies for performing host key verification for administrators to select the one that meet...
CVE-2022-36881
Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks...
PT-2022-5835 · Jenkins · Jenkins Git Client Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Git client Plugin versions 3.11.0 and earlier Description: The issue is related to the lack of SSH host key verification when connecting to Git repositories via SSH, which enables man-in-the-middle attacks. This is due to shortcomings...
Missing hostname verification in git-client
git-client 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH. This lack of verification could be abused using a man-in-the-middle attack to intercept these connections. git-client 3.11.1 provides strategies for performing host key verificati...
GHSA-X654-4WJH-74Q6 Jenkins SSH Build Agents Plugin did not verify host keys
It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks...
GHSA-322X-JV5H-CVJH Jenkins Ansible Plugin man in the middle vulnerability
A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that...
GO-2020-0013 Man-in-the-middle attack in golang.org/x/crypto/ssh
By default host key verification is disabled which allows for man-in-the-middle attacks against SSH clients if ClientConfig.HostKeyCallback is not set...
CVE-2019-8901
This issue was addressed by verifying host keys when connecting to a previously-known SSH server. This issue is fixed in iOS 13.1 and iPadOS 13.1. An attacker in a privileged network position may be able to intercept SSH traffic from the “Run script over SSH” action...
Arbitrary Memory Overwrite
putty is vulnerable to arbitrary memory overwrite. A remote attacker is able to exploit the vulnerability to write arbitrary data into memory during the RSA key exchange before host key verification...
CVE-2019-16546
Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks...
google-compute-engine did not verify SSH host keys
google-compute-engine did not use SSH host key verification when connecting to VMs launched by the plugin. This lack of verification could be abused by a MitM attacker to intercept these connections to attacker-specified build agents without warning. google-compute-engine now verifies SSH host ke...
atomic-openshift: OpenShift builds don't verify SSH Host Keys for the git repository
It was found that OpenShift Container Platform does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output...
Fedora 29 : filezilla (2019-10812c1db6)
Backport a security fix from PuTTY 0.71 affecting SFTP connections: Fix an integer overflow in the RSA key exchange preceeding host key verification Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempt...
ALPINE-CVE-2019-9894
A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification...
CVE-2019-9894
A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification...
CVE-2019-9894
A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification...
