CVE-2022-28142 SSL/TLS certificate validation globally disabled by Jenkins Proxmox Plugin
The Jenkins Proxmox Plugin disables global SSL/TLS validation when configured to ignore issues, allowing man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-28142?
CVE-2022-28142 is a high-severity vulnerability in Jenkins Proxmox Plugin, published on 29 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to ignore SSL/TLS issues.
Weakness: CWE-295
Which versions are affected by CVE-2022-28142?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:proxmox. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:proxmox Maven | All versions | 0.7.0 |
org.jenkins-ci.plugins:proxmox Maven | All versions | 0.7.0 |
Products include Jenkins Proxmox.
How do I fix CVE-2022-28142?
Upgrade org.jenkins-ci.plugins:proxmox to 0.7.0 or later.
Is CVE-2022-28142 being exploited?
There is no known exploitation of CVE-2022-28142 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Proxmox Plugin
Sources
Also known as GHSA-fhhx-r983-44xc.