CVE-2019-10334 Jenkins ElectricFlow Plugin globally and unconditionally disabled SSL/TLS certificate validation
The plugin disables SSL/TLS and hostname verification globally, allowing attackers to intercept or manipulate encrypted communications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10334?
CVE-2019-10334 is a medium-severity vulnerability in Jenkins ElectricFlow Plugin, published on 11 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used to upload files.
Weakness: CWE-295
Which versions are affected by CVE-2019-10334?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:electricflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:electricflow Maven | All versions | 1.1.7 |
org.jenkins-ci.plugins:electricflow Maven | All versions | 1.1.7 |
Products include Jenkins Electricflow.
How do I fix CVE-2019-10334?
Upgrade org.jenkins-ci.plugins:electricflow to 1.1.7 or later.
Is CVE-2019-10334 being exploited?
There is no known exploitation of CVE-2019-10334 in the wild and no public exploit code.
Other vulnerabilities in Jenkins ElectricFlow Plugin
- CVE-2019-10336 Jenkins ElectricFlow Plugin is vulnerable to reflected cross site scripting vulnerability
- CVE-2019-10335 Jenkins ElectricFlow Plugin is vulnerable to stored cross site scripting vulnerability
- CVE-2019-10331 Jenkins ElectricFlow Plugin cross-site request forgery vulnerability
- CVE-2019-10332 Jenkins ElectricFlow Plugin missing permission check
- CVE-2019-10333 Jenkins ElectricFlow Plugin Missing permission checks
Sources
Also known as GHSA-xmqv-pfw7-qmj7.