medium4.8
CVE-2019-10444
Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation
Impact
Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation for connections to the HP ALM service. Bumblebee HP ALM Plugin no longer does that. Instead, it now allows users to opt out of certificate validation.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:bumblebee | <= 4.1.3 | 4.1.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Bumblebee Hp Alm | through 4.1.3 |