CVE-2020-2185
First published: Wed May 06 2020(Updated: )
Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not use SSH host key validation when connecting to agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents. Jenkins Amazon EC2 Plugin 1.50.2 provides strategies for performing host key validation for administrators to select the one that meets their security needs. It includes assistance for administrators to migrate to a new, more secure strategy. For more information see [the plugin documentation](https://github.com/jenkinsci/ec2-plugin/#securing-the-connection-to-unix-amis).
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Amazon Ec2 | <=1.50.1 | |
| maven/org.jenkins-ci.plugins:ec2 | <=1.50.1 | 1.50.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2020/05/06/3
- https://jenkins.io/security/advisory/2020-05-06/#SECURITY-381
- https://nvd.nist.gov/vuln/detail/CVE-2020-2185
- https://github.com/jenkinsci/ec2-plugin/commit/4c9f03ae202e4730fd54eda40771fa4d3873e358
- https://github.com/advisories/GHSA-q8qq-2p5p-rg44 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this Jenkins Amazon EC2 Plugin vulnerability?
The vulnerability ID for this Jenkins Amazon EC2 Plugin vulnerability is CVE-2020-2185.
What is the severity rating of CVE-2020-2185?
CVE-2020-2185 has a severity rating of 5.6, which is considered medium.
What is the description of CVE-2020-2185?
CVE-2020-2185 is a vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier that allows man-in-the-middle attacks due to lack of SSH host key validation.
Which software versions are affected by CVE-2020-2185?
Jenkins Amazon EC2 Plugin versions up to and including 1.50.1 are affected by CVE-2020-2185.
How can I fix the CVE-2020-2185 vulnerability?
To fix the CVE-2020-2185 vulnerability, update Jenkins Amazon EC2 Plugin to a version higher than 1.50.1 that includes the fix.
- collector/nvd-index
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-q8qq-2p5p-rg44
- alias/CVE-2020-2185
- collector/nvd-cve
- collector/github-advisory
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/jenkins
- canonical/jenkins amazon ec2
- version/jenkins amazon ec2/1.50.1
- package-manager/maven