Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7865 advisory.

  - jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client (CVE-2022-36881)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to
    Git repositories via SSH, enabling man-in-the-middle attacks. (CVE-2022-36881)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0017 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.8.56. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2023:0018

    Security Fix(es):

    * Pipeline Shared Groovy Libraries: Untrusted users can modify some     Pipeline libraries in Pipeline Shared Groovy Libraries Plugin     (CVE-2022-29047)
    * Jenkins plugin: Sandbox bypass vulnerability through implicitly     allowlisted platform Groovy files in Pipeline: Groovy Plugin     (CVE-2022-30945)
    * Jenkins plugin: Mercurial SCM plugin can check out from the controller     file system (CVE-2022-30948)
    * jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step     Plugin (CVE-2022-34177)
    * jenkins-plugin: Man-in-the-Middle (MitM) in     org.jenkins-ci.plugins:git-client (CVE-2022-36881)
    * http2-server: Invalid HTTP/2 requests cause DoS (CVE-2022-2048)
    * Jenkins plugin: CSRF vulnerability in Script Security Plugin     (CVE-2022-30946)
    * Jenkins plugin: User-scoped credentials exposed to other users by     Pipeline SCM API for Blue Ocean Plugin (CVE-2022-30952)
    * Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953)
    * Jenkins plugin: missing permission checks in Blue Ocean Plugin     (CVE-2022-30954)
    * jenkins: Observable timing discrepancy allows determining username     validity (CVE-2022-34174)
    * jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin     (CVE-2022-34176)
    * jenkins-plugin: Cross-site Request Forgery (CSRF) in     org.jenkins-ci.plugins:git (CVE-2022-36882)
    * jenkins plugin: Lack of authentication mechanism in Git Plugin webhook     (CVE-2022-36883)
    * jenkins plugin: Lack of authentication mechanism in Git Plugin webhook     (CVE-2022-36884)
    * jenkins plugin: Non-constant time webhook signature comparison in GitHub     Plugin (CVE-2022-36885)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0017 advisory.

  - http2-server: Invalid HTTP/2 requests cause DoS (CVE-2022-2048)

  - Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin     (CVE-2022-29047)

  - plugin: Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Pipeline:
    Groovy Plugin (CVE-2022-30945)

  - plugin: CSRF vulnerability in Script Security Plugin (CVE-2022-30946)

  - plugin: Mercurial SCM plugin can check out from the controller file system (CVE-2022-30948)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7865 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.10.41. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2002:7866

    Security Fix(es):

    * jenkins-plugin: Man-in-the-Middle (MitM) in     org.jenkins-ci.plugins:git-client (CVE-2022-36881)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.10 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.303.x prior to 2.303.30.0.15, or 2.x prior to 2.346.2.3. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows     attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause     them to check out an attacker-specified commit. (CVE-2022-36882)

  - Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of     the applications when configuring a deployment, allowing attackers with Item/Configure permission to     upload arbitrary files from the Jenkins controller file system to the selected service. (CVE-2022-36889)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows     attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained     through another method, capturing credentials stored in Jenkins. (CVE-2022-36920)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
312078	RHCOS 4 : OpenShift Container Platform 4.10.41 (RHSA-2022:7865)	Nessus	Red Hat Local Security Checks	Local	high
413964	SCA: security update for org.jenkins-ci.plugins:git-client (GHSA-cm7j-p8hc-97vj)	Tenable Cloud Security	SCA Checks	Local	high
413964	SCA: security update for org.jenkins-ci.plugins:git-client (GHSA-cm7j-p8hc-97vj)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
194338	RHEL 8 : OpenShift Container Platform 4.8.56 (RHSA-2023:0017)	Nessus	Red Hat Local Security Checks	Local	high
189418	RHCOS 4 : OpenShift Container Platform 4.8.56 (RHSA-2023:0017)	Nessus	Red Hat Local Security Checks	Local	high
170379	RHEL 8 : OpenShift Container Platform 4.10.41 (RHSA-2022:7865)	Nessus	Red Hat Local Security Checks	Local	high
165764	Jenkins Enterprise and Operations Center 2.303.x < 2.303.30.0.15 / 2.346.2.3 Multiple Vulnerabilities (CloudBees Security Advisory 2022-07-27)	Nessus	CGI abuses	Combined	high

Detections

Analytics

CVE-2022-36881

high

Tenable Plugins

high

high

high

high

high

high

high