What is GHSA-322x-jv5h-cvjh?

GHSA-322x-jv5h-cvjh is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins Ansible Plugin man in the middle vulnerability

Which CVE IDs does GHSA-322x-jv5h-cvjh cover?

GHSA-322x-jv5h-cvjh covers the following CVE IDs: CVE-2018-1000149. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-322x-jv5h-cvjh?

GHSA-322x-jv5h-cvjh has a CVSS v3 base score of 5.6, published by GitHub Security Advisories.

Which products are affected by GHSA-322x-jv5h-cvjh?

GHSA-322x-jv5h-cvjh affects 1 product, including: maven/org.jenkins-ci.plugins:ansible:\u003c= 0.8.

GHSA-322x-jv5h-cvjhMediumCVSS 5.6

Jenkins Ansible Plugin man in the middle vulnerability

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

December 7, 2023

🔗 CVE IDs covered (1)

CVE-2018-1000149 →

📋 Description

A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that disables host key verification by default. Ansible Plugin 1.0 now enables host key verification by default, adding options allowing users to opt out.

🎯 Affected products1

maven/org.jenkins-ci.plugins:ansible:<= 0.8

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000149
https://jenkins.io/security/advisory/2018-03-26/#SECURITY-630
https://github.com/jenkinsci/ansible-plugin/commit/06d30e5b626a978e258a7f4ab473cd7f53a7cba7
https://github.com/advisories/GHSA-322x-jv5h-cvjh