CVE-2018-1000149 Jenkins Ansible Plugin man in the middle vulnerability

What is CVE-2018-1000149?

CVE-2018-1000149 is a medium-severity vulnerability in n/a, published on 5 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that disables host key verification by default.

Which versions are affected by CVE-2018-1000149?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:ansible. It affects 1 product.

Products include Jenkins Ansible.

How do I fix CVE-2018-1000149?

Upgrade org.jenkins-ci.plugins:ansible to 1.0 or later.

Is CVE-2018-1000149 being exploited?

There is no known exploitation of CVE-2018-1000149 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-32983 Jenkins Ansible Plugin job configuration form does not mask variables Medium 5.3
• CVE-2023-32982 Jenkins Ansible Plugin stores and displays secrets in plain text Medium 4.3
• CVE-2020-2310 Missing permission checks in Jenkins Ansible Plugin allow enumerating credentials IDs Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-322x-jv5h-cvjh.