CVE-2018-1000149: Medium severity jenkins vulnerability

Q: What is the severity of CVE-2018-1000149?

CVE-2018-1000149 is classified as a medium severity vulnerability.

Q: How do I fix CVE-2018-1000149?

To fix CVE-2018-1000149, upgrade the Jenkins Ansible Plugin to version 1.0 or later.

Q: What kind of attack does CVE-2018-1000149 enable?

CVE-2018-1000149 enables a man-in-the-middle attack on Jenkins Ansible Plugin versions 0.8 and older.

Q: Which versions of the Jenkins Ansible Plugin are affected by CVE-2018-1000149?

Versions of the Jenkins Ansible Plugin prior to 1.0 are affected by CVE-2018-1000149.

Q: What components are involved in CVE-2018-1000149?

CVE-2018-1000149 involves several classes including AbstractAnsibleInvocation.java and AnsiblePlaybookBuilder.java.

Published Apr 5, 2018

Updated

A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that disables host key verification by default. Ansible Plugin 1.0 now enables host key verification by default, adding options allowing users to opt out.

Other sources

Affected Software

2 affected componentsFixes available

maven/org.jenkins-ci.plugins:ansible<=0.8

1.0

Jenkins Ansible Jenkins<=0.8

Event History

Apr 5, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

Description

May 13, 2022

Advisory Published

01:18 AM

Frequently Asked Questions

What is the severity of CVE-2018-1000149?

CVE-2018-1000149 is classified as a medium severity vulnerability.

How do I fix CVE-2018-1000149?