medium5.6
CVE-2018-1000149
Jenkins Ansible Plugin man in the middle vulnerability
Impact
A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in `AbstractAnsibleInvocation.java`, `AnsibleAdHocCommandBuilder.java`, `AnsibleAdHocCommandInvocationTest.java`, `AnsibleContext.java`, `AnsibleJobDslExtension.java`, `AnsiblePlaybookBuilder.java`, `AnsiblePlaybookStep.java` that disables host key verification by default. Ansible Plugin 1.0 now enables host key verification by default, adding options allowing users to opt out.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:ansible | <= 0.8 | 1.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Ansible | through 0.8 |