CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36881 – jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client
https://notcve.org/view.php?id=CVE-2022-36881
Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Jenkins Git client Plugin versiones 3.11.0 y anteriores, no lleva a cabo la verificación de la clave del host SSH cuando es conectado a repositorios Git por medio de SSH, lo que permite realizar ataques de tipo man-in-the-middle A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks. • http://www.openwall.com/lists/oss-security/2022/07/27/1 https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468 https://access.redhat.com/security/cve/CVE-2022-36881 https://bugzilla.redhat.com/show_bug.cgi?id=2114755 • CWE-295: Improper Certificate Validation CWE-322: Key Exchange without Entity Authentication •
CVSS: 8.8EPSS: 94%CPEs: 2EXPL: 1CVE-2019-10392 – jenkins-git-client-plugin: OS command injection via 'git ls-remote'
https://notcve.org/view.php?id=CVE-2019-10392
Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection. Jenkins Git Client Plugin versión 2.8.4 y versiones anteriores y versión 3.0.0-rc , no restringían apropiadamente los valores pasados como argumento de la URL en una invocación de "git ls-remote", resultando en una inyección de comandos del Sistema Operativo. • https://github.com/jas502n/CVE-2019-10392 http://www.openwall.com/lists/oss-security/2019/09/12/2 https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1534 https://access.redhat.com/security/cve/CVE-2019-10392 https://bugzilla.redhat.com/show_bug.cgi?id=1819704 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000242
https://notcve.org/view.php?id=CVE-2017-1000242
Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure La versión 2.4.2 y anteriores del plugin Git Client de Jenkins crean un archivo temporal con permisos inseguros, lo que resulta en la revelación de información. • http://www.securityfocus.com/bid/101940 https://jenkins.io/security/advisory/2017-04-27 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •