Jenkins Git client plugin 3.11.0 does not perform SSH host key verification

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-36881 · ADVISORY
• jenkinsci/git-client-plugin commit 88f52c6 · WEB
• jenkinsci/git-client-plugin · PACKAGE
• jenkins.io/security/advisory/2022-07-27 · WEB
• openwall.com/lists/oss-security/2022/07/27/1 · WEB

Weitere Schwachstellen in org.jenkins-ci.plugins:git-client

• CVE-2026-57282MITTEL 5.0Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH …
• CVE-2025-67640MITTEL 5.0Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a te…
• CVE-2025-58458MITTEL 4.3In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the …
• CVE-2019-10392HOCH 8.8Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls…
• CVE-2017-1000242NIEDRIG 3.3Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure