medium6.8
CVE-2019-16546
Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin
Impact
Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks. Google Compute Engine Plugin 4.2.0 verifies SSH host keys before executing any commands on agents.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:google-compute-engine | <= 4.1.1 | 4.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Google Compute Engine | before 4.2.0 |