CVE-2020-2187
First published: Wed May 06 2020(Updated: )
Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-middle attacks.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Amazon Ec2 | <=1.50.1 | |
| maven/org.jenkins-ci.plugins:ec2 | <=1.50.1 | 1.50.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2020/05/06/3
- https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1528
- https://nvd.nist.gov/vuln/detail/CVE-2020-2187
- https://github.com/jenkinsci/ec2-plugin/commit/4c9f03ae202e4730fd54eda40771fa4d3873e358
- https://github.com/advisories/GHSA-c89c-pvm7-33wj (Advisory)
Frequently Asked Questions
What is the severity of CVE-2020-2187?
The severity of CVE-2020-2187 is medium.
How does Jenkins Amazon EC2 Plugin 1.50.1 and earlier accept self-signed certificates?
Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed HTTPS certificates.
Does Jenkins Amazon EC2 Plugin 1.50.1 and earlier perform hostname validation when connecting to Windows agents?
No, Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not perform hostname validation when connecting to Windows agents.
What is the potential risk of CVE-2020-2187?
The lack of validation in Jenkins Amazon EC2 Plugin 1.50.1 and earlier could be abused through a man-in-the-middle attack.
How can I fix CVE-2020-2187?
To fix CVE-2020-2187, update to version 1.50.2 of Jenkins Amazon EC2 Plugin or later.
- collector/nvd-index
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-c89c-pvm7-33wj
- alias/CVE-2020-2187
- collector/github-advisory
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/tags
- agent/type
- agent/description
- agent/event
- vendor/jenkins
- canonical/jenkins amazon ec2
- version/jenkins amazon ec2/1.50.1
- package-manager/maven