CVE-2019-16546 Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin

What is CVE-2019-16546?

CVE-2019-16546 is a medium-severity vulnerability in Jenkins Google Compute Engine Plugin, published on 21 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.

Weakness: CWE-639

Which versions are affected by CVE-2019-16546?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:google-compute-engine. It affects 1 product.

Products include Jenkins Google Compute Engine.

How do I fix CVE-2019-16546?

Upgrade org.jenkins-ci.plugins:google-compute-engine to 4.2.0 or later.

Is CVE-2019-16546 being exploited?

There is no known exploitation of CVE-2019-16546 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Google Compute Engine Plugin

• CVE-2023-49673 Jenkins NeuVector Vulnerability Scanner Plugin Cross-Site Request Forgery vulnerability High 8.8
• CVE-2019-16548 Jenkins Google Compute Engine Plugin Cross-Site Request Forgery vulnerability High 8.8
• CVE-2022-29052 Private key stored in plain text by Jenkins Google Compute Engine Plugin Medium 4.3
• CVE-2019-16547 Jenkins Google Compute Engine Plugin Missing Authorization vulnerability Medium 4.3
• CVE-2023-49652 Jenkins Google Compute Engine Plugin has incorrect permission checks Low 2.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-345p-pw5q-g98v.