GHSA-345p-pw5q-g98vMediumCVSS 6.8

Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin

Published
May 24, 2022
Last Modified
January 31, 2023

🔗 CVE IDs covered (1)

CVE-2019-16546 →

📋 Description

Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks. Google Compute Engine Plugin 4.2.0 verifies SSH host keys before executing any commands on agents.

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:google-compute-engine:<= 4.1.1

🔗 References (4)