CVE-2020-2146 Missing SSH host key validation in Mac Plugin
Jenkins Mac Plugin fails to validate SSH host keys, allowing man-in-the-middle attacks that could lead to agent compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-2146?
CVE-2020-2146 is a high-severity vulnerability in Jenkins Mac Plugin, published on 9 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.
Weakness: CWE-347
Which versions are affected by CVE-2020-2146?
2 open source packages ship an affected version, including fr.edf.jenkins.plugins:mac. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fr.edf.jenkins.plugins:mac Maven | All versions | 1.2.0 |
fr.edf.jenkins.plugins:mac Maven | All versions | 1.2.0 |
Products include Jenkins Mac.
How do I fix CVE-2020-2146?
Upgrade fr.edf.jenkins.plugins:mac to 1.2.0 or later.
Is CVE-2020-2146 being exploited?
There is no known exploitation of CVE-2020-2146 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Mac Plugin
Sources
Also known as GHSA-rv9g-67f7-grq7.