EUVD-2022-5724

Malicious code in bioql PyPI...

org.jenkins-ci.plugins:anka-build (>=1.12, <=1.13), org.jenkins-ci.plugins:openstack-cloud (>=2.18, <=2.42) +1 more potentially affected by CVE-2024-47805 via org.jenkins-ci.plugins:credentials (2.1.2)

org.jenkins-ci.plugins:credentials MAVEN version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:anka-build =1.12, =2.18, =1.12, =1.17 Source cves: CVE-2024-47805...

org.jvnet.hudson.main:hudson-test-harness (1.280), org.jvnet.hudson.main:hudson-war (1.280) +2 more potentially affected by CVE-2015-8031 via org.jvnet.hudson.main:hudson-core (1.280)

org.jvnet.hudson.main:hudson-core MAVEN version 1.280 is affected by a known vulnerability. The following packages have a transitive dependency on org.jvnet.hudson.main:hudson-core and may be impacted: - org.jvnet.hudson.main:hudson-test-harness 1.280 - org.jvnet.hudson.main:hudson-war 1.280 -...

org.jvnet.hudson.main:hudson-war (1.224), org.jvnet.hudson.plugins:cvs-tag (1.1) +2 more potentially affected by CVE-2015-8031 via org.jvnet.hudson.main:hudson-core (1.224)

org.jvnet.hudson.main:hudson-core MAVEN version 1.224 is affected by a known vulnerability. The following packages have a transitive dependency on org.jvnet.hudson.main:hudson-core and may be impacted: - org.jvnet.hudson.main:hudson-war 1.224 - org.jvnet.hudson.plugins:cvs-tag 1.1 -...

org.jenkins-ci.plugins:ssh-slaves (0.23) potentially affected by CVE-2018-1000601 via org.jenkins-ci.plugins:ssh-credentials (0.1)

org.jenkins-ci.plugins:ssh-credentials MAVEN version 0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:ssh-credentials and may be impacted: - org.jenkins-ci.plugins:ssh-slaves 0.23 Source cves: CVE-2018-1000601 Source advisory:...

org.jenkins-ci.plugins:crx-content-package-deployer (>=1.0, <=1.4), org.jenkins-ci.plugins:ssh-agent (1.1) +1 more potentially affected by CVE-2018-1000601 via org.jenkins-ci.plugins:ssh-credentials (0.3)

org.jenkins-ci.plugins:ssh-credentials MAVEN version 0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:ssh-credentials and may be impacted: - org.jenkins-ci.plugins:crx-content-package-deployer =1.0, =0.24, =0.27 Source cves:...

com.amazon.jenkins.fleet:ec2-fleet (>=1.0, <=1.1.2), com.cloudbees.jenkins.plugins:mansion-cloud (>=1.16, <=1.31) +14 more potentially affected by CVE-2017-2648 via org.jenkins-ci.plugins:ssh-slaves (>=1.5, <=1.13)

org.jenkins-ci.plugins:ssh-slaves MAVEN version =1.5, =1.0, =1.16, =0.1.0, =0.1.0-alpha5, =0.1, =1.2.8, =2.0.0, =1.3, =1.2.0, =2.9, =1.1, =1.5, =1.3, =1.4 and more Source cves: CVE-2017-2648 Source advisory: OSV:GHSA-X654-4WJH-74Q6...

com.amazon.jenkins.fleet:ec2-fleet (>=1.0, <=1.1.2), com.cloudbees.jenkins.plugins:mansion-cloud (>=1.16, <=1.31) +14 more potentially affected by CVE-2017-2648 via org.jenkins-ci.plugins:ssh-slaves (>=1.5, <=1.13)

org.jenkins-ci.plugins:ssh-slaves MAVEN version =1.5, =1.0, =1.16, =0.1.0, =0.1.0-alpha5, =0.1, =1.2.8, =2.0.0, =1.3, =1.2.0, =2.9, =1.1, =1.5, =1.3, =1.4 and more Source cves: CVE-2017-2648 Source advisory: GHSA-X654-4WJH-74Q6...

org.jenkins-ci.plugins:git-client (>=1.1.2, <=1.4.5), org.jenkins-ci.plugins:job-dsl (>=1.18, <=1.19) +4 more potentially affected by CVE-2021-21648 via org.jenkins-ci.plugins:credentials (1.6)

org.jenkins-ci.plugins:credentials MAVEN version 1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:git-client =1.1.2, =1.18, =1.2, =1.0, =1.0, =1.2 -...

CVE-2017-2648

It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks...

com.amazon.jenkins.fleet:ec2-fleet (>=1.0, <=1.1.2), com.cloudbees.jenkins.plugins:mansion-cloud (>=1.16, <=1.31) +14 more potentially affected by CVE-2017-2648 via org.jenkins-ci.plugins:ssh-slaves (>=1.5, <=1.13)

org.jenkins-ci.plugins:ssh-slaves MAVEN version =1.5, =1.0, =1.16, =0.1.0, =0.1.0-alpha5, =0.1, =1.2.8, =2.0.0, =1.3, =1.2.0, =2.9, =1.1, =1.5, =1.3, =1.4 and more Source cves: CVE-2017-2648 Source advisory: MEND:CVE-2017-2648...

CVE-2017-2648

The CVE-2017-2648 issue affects the Jenkins SSH Slaves Plugin; before version 1.15 it did not verify host keys, enabling Man-in-the-Middle attacks. Impact is network-based, with potential for interception of communications between the master and agents. The commonly cited remediation is to upgrad...

CVE-2017-2648: Improper Certificate Validation

It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks...

PT-2018-7156

Name of the Vulnerable Software and Affected Versions: jenkins-ssh-slaves-plugin versions prior to 1.15 Description: The issue allows for Man-in-the-Middle attacks due to the lack of host key verification. Recommendations: For versions prior to 1.15, update to version 1.15 or later to resolve the...

Fedora Update for jenkins-ssh-slaves-plugin FEDORA-2014-15776

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...