Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation

MEDIUM 6.5CVE-2019-10444 · GHSA-qgp8-h5cp-r75r · Published 16/10/2019 · updated 17/06/2026

In short

CVE-2019-10444 is a MEDIUM (CVSS 6.5) vulnerability affecting org.jenkins-ci.plugins:bumblebee, bumblebee hp alm (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.80%, higher than 56.7% of all vulnerabilities.
Fix: update to 4.1.4 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:bumblebee Maven	`< 4.1.4`	`4.1.4`
bumblebee hp alm jenkins	`≤ 4.1.3`	No fix yet

Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation for connections to the HP ALM service.

Bumblebee HP ALM Plugin no longer does that. Instead, it now allows users to opt out of certificate validation.

NVD description

Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.