CVE-2017-1000397

https://notcve.org/view.php?id=CVE-2017-1000397

Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dependency on commons-httpclient. El plugin Jenkins Maven 2.73.1 y anteriores y 2.17 y anteriores incluía una versión de la biblioteca commons-httpclient con la vulnerabilidad CVE-2012-6153 que verificaba incorrectamente los certificados SSL, volviéndolo susceptible a ataques de Man-in-the-Middle (MitM). El plugin Maven 3.0 ya no depende de commons-httpclient. • https://jenkins.io/security/advisory/2017-10-11 • CWE-20: Improper Input Validation •