CVE-2020-2187
First published: Wed May 06 2020(Updated: )
Amazon EC2 Plugin connects to Windows agents via HTTPS. Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed HTTPS certificates and does not perform hostname validation when connecting to Windows agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents. Amazon EC2 Plugin 1.50.2 by default no longer accepts self-signed HTTPS certificates and performs hostname validation. A new configuration option allows restoring the previous, unsafe behavior. For more information see [the plugin documentation](https://github.com/jenkinsci/ec2-plugin/#securing-the-connection-to-windows-amis).
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.jenkins-ci.plugins:ec2 | <=1.50.1 | 1.50.2 |
| Jenkins Amazon Ec2 | <=1.50.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2020/05/06/3
- https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1528
- https://nvd.nist.gov/vuln/detail/CVE-2020-2187
- https://github.com/jenkinsci/ec2-plugin/commit/4c9f03ae202e4730fd54eda40771fa4d3873e358
- https://github.com/advisories/GHSA-c89c-pvm7-33wj (Advisory)
Frequently Asked Questions
What is the severity of CVE-2020-2187?
The severity of CVE-2020-2187 is medium.
How does Jenkins Amazon EC2 Plugin 1.50.1 and earlier accept self-signed certificates?
Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed HTTPS certificates.
Does Jenkins Amazon EC2 Plugin 1.50.1 and earlier perform hostname validation when connecting to Windows agents?
No, Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not perform hostname validation when connecting to Windows agents.
What is the potential risk of CVE-2020-2187?
The lack of validation in Jenkins Amazon EC2 Plugin 1.50.1 and earlier could be abused through a man-in-the-middle attack.
How can I fix CVE-2020-2187?
To fix CVE-2020-2187, update to version 1.50.2 of Jenkins Amazon EC2 Plugin or later.
- collector/nvd-index
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-c89c-pvm7-33wj
- alias/CVE-2020-2187
- collector/github-advisory
- agent/type
- agent/softwarecombine
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/last-modified-date
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/jenkins
- canonical/jenkins amazon ec2
- version/jenkins amazon ec2/1.50.1
- package-manager/maven