high7.4
CVE-2018-1999035
Jenkins Inedo BuildMaster Plugin globally and unconditionally disabled SSL/TLS certificate validation
Impact
A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMasterApi.java that allows attackers to impersonate any service that Jenkins connects to.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.inedo.buildmaster:inedo-buildmaster | <= 1.3 | 2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Inedo Buildmaster | through 1.3 |