Jenkins Swarm Plugin Client vulnerable to man-in-the-middle attacks

MEDIUM 5.9CVE-2017-1000402 · GHSA-pj45-8vhc-mh2f · Published 26/01/2018 · updated 17/06/2026

In short

CVE-2017-1000402 is a MEDIUM (CVSS 5.9) vulnerability affecting org.jenkins-ci.plugins:swarm-client, org.jvnet.hudson.plugins:swarm-plugin, swarm (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 42.2% of all vulnerabilities.
Fix: update to 3.5 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:swarm-client Maven	`< 3.5`	`3.5`
org.jvnet.hudson.plugins:swarm-plugin Maven	`≤ 1.5`	No fix yet
swarm jenkins	`≤ 3.4`	No fix yet

Description

Jenkins Swarm Plugin Client 3.4 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-1000402 · ADVISORY
jenkins.io/security/advisory/2017-10-11 · WEB
jenkins.io/security/advisory/2017-10-11 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free