CVE-2019-10334: Medium severity jenkins electricflow vulnerability
CloudBees CD Plugin unconditionally disabled SSL/TLS certificate validation for the entire Jenkins controller JVM during the deployment/publication of an application.
CloudBees CD Plugin no longer does that. Instead, the existing opt-in option to ignore SSL/TLS errors is used during deployment for the specific connection.
This issue was caused by an incomplete fix for SECURITY-937.
Other sources
Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used to upload files.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10334?
CVE-2019-10334 is a vulnerability found in the Jenkins ElectricFlow Plugin that disabled SSL/TLS and hostname verification globally.
How does CVE-2019-10334 affect CloudBees CD Plugin?
CVE-2019-10334 affects CloudBees CD Plugin as it unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM during deployment/publication of an application.
What is the severity of CVE-2019-10334?
CVE-2019-10334 has a severity of medium with a CVSS score of 6.5.
How can I fix CVE-2019-10334?
To fix CVE-2019-10334, update your CloudBees CD Plugin to version 1.1.7 or higher.
Where can I find more information about CVE-2019-10334?
You can find more information about CVE-2019-10334 at the following references: [http://www.openwall.com/lists/oss-security/2019/06/11/1](http://www.openwall.com/lists/oss-security/2019/06/11/1), [http://www.securityfocus.com/bid/108747](http://www.securityfocus.com/bid/108747), [https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1411](https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1411).