VulnerabilityModified
CVE-2019-16546
Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.
MEDIUM 5.9EPSS 0.87%
Does this matter?
Lower severity and a low EPSS score (0.87%). Track it; it rarely justifies an emergency change on its own.
Description
Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.87% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-639
- Affected
- jenkins/google compute engine
- Source
- jenkinsci-cert@googlegroups.com
References
- http://www.openwall.com/lists/oss-security/2019/11/21/1Mailing List, Third Party Advisory
- https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1584Vendor Advisory
- http://www.openwall.com/lists/oss-security/2019/11/21/1Mailing List, Third Party Advisory
- https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1584Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.