PT-2025-36619

In Jenkins Git client Plugin 6.3.2 and earlier, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying amazon-s3 protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an...

PT-2025-35780

Name of the Vulnerable Software and Affected Versions: Jenkins Git client Plugin versions 6.3.2 and earlier Description: The Git URL field form validation responses differ based on whether the specified file path exists on the Jenkins controller when using the amazon-s3 protocol with JGit. This...

Jenkins Plugin Git client 安全漏洞

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application software. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security...

CVE-2025-58458: Exposure of Sensitive Information to an Unauthorized Actor

In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying amazon-s3 protocol for use with JGit, allowing attackers with Overall/Read permission to check f...

On the Prevalence and Usage of Commit Signing on GitHub: a Longitudinal and Cross-Domain Study

GitHub is one of the most widely used public code development platform. However, the code hosted publicly on the platform is vulnerable to commit spoofing that allows an adversary to introduce malicious code or commits into the repository by spoofing the commit metadata to indicate that the code...

The vulnerability of the SourceTree visual Git client, related to improper code generation management, allows a hacker to execute arbitrary code.

The vulnerability of the visual Git client SourceTree is related to incorrect code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

com.paul8620.jenkins.plugins:pipeline-aggregator-view (>=114.v98e9735f6193, <=119.v4b_ec11953552), com.tikalk.hudson.plugins:notification (1.18) +20 more potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1341.va_2819b_414686)

org.jenkins-ci.plugins:script-security MAVEN version 1341.va2819b414686 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.paul8620.jenkins.plugins:pipeline-aggregator-view...

jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client

A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks...

The vulnerability of the SSH Host Key Verification component of the Jenkins Git Client Plugin allows a perpetrator to execute a “man-in-the-middle” type attack.

The vulnerability of the SSH Host Key Verification component in the Jenkins Git Client Plugin is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute a “man-in-the-middle” attack remotely...

jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client

A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks...

jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client

A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks...

CVE-2022-36881

A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks...

io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45), org.jenkins-ci.plugins:git (3.0.0) +3 more potentially affected by CVE-2022-36881 via org.jenkins-ci.plugins:git-client (2.0.0)

org.jenkins-ci.plugins:git-client MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =y, =0.25, =0.5, =0.6 Source cves: CVE-2022-36881...

org.jenkins-ci.plugins:fitnesse (>=1.12, <=1.13), org.jenkins-ci.plugins:git (>=1.4.0, <=1.5.0) +2 more potentially affected by CVE-2022-36881 via org.jenkins-ci.plugins:git-client (1.0.6)

org.jenkins-ci.plugins:git-client MAVEN version 1.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:fitnesse =1.12, =1.4.0, =1.0, =0.1, =0.4 Source cves: CVE-2022-36881...

org.jenkins-ci.plugins:git (2.5.0-beta1) potentially affected by CVE-2022-36881 via org.jenkins-ci.plugins:git-client (1.20.0-beta1)

org.jenkins-ci.plugins:git-client MAVEN version 1.20.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:git 2.5.0-beta1 Source cves: CVE-2022-36881 Source advisory:...

org.jenkins-ci.plugins:git (3.9.4) potentially affected by CVE-2022-36881 via org.jenkins-ci.plugins:git-client (2.7.7)

org.jenkins-ci.plugins:git-client MAVEN version 2.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:git 3.9.4 Source cves: CVE-2022-36881 Source advisory:...

org.jenkins-ci.plugins:git (1.6.0-beta-1) potentially affected by CVE-2022-36881 via org.jenkins-ci.plugins:git-client (1.2.0)

org.jenkins-ci.plugins:git-client MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:git 1.6.0-beta-1 Source cves: CVE-2022-36881 Source advisory:...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=0.1-beta-1, <=0.1-beta-4), org.jenkins-ci.plugins.workflow:workflow-scm-step (>=0.1-beta-1, <=0.1-beta-4) +2 more potentially affected by CVE-2022-36881 via org.jenkins-ci.plugins:git-client (1.9.0)

org.jenkins-ci.plugins:git-client MAVEN version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator =0.1-beta-1, =0.1-beta-1, =1.6.1, =1.6.7...

com.coravy.hudson.plugins.github:github (>=1.28.0, <=1.29.4), io.jenkins.blueocean:blueocean (>=1.1.0-beta-1, <=1.2.0-beta-1) +12 more potentially affected by CVE-2022-36881 via org.jenkins-ci.plugins:git-client (2.4.0)

org.jenkins-ci.plugins:git-client MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - com.coravy.hudson.plugins.github:github =1.28.0, =1.1.0-beta-1, =1.1.0-beta-1, =1.1.0-beta-1,...

com.coravy.hudson.plugins.github:github (>=1.14.0-alpha-1, <=1.27.0), com.elasticbox.jenkins-ci.plugins:elasticbox (>=4.1.1, <=4.1.6) +12 more potentially affected by CVE-2022-36881 via org.jenkins-ci.plugins:git-client (1.18.0)

org.jenkins-ci.plugins:git-client MAVEN version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - com.coravy.hudson.plugins.github:github =1.14.0-alpha-1, =4.1.1, =1.0, =1.1.0, =1.33.2, =1.0...