| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:electricflow | < 1.1.7 | 1.1.7 |
| electricflow | ≤ 1.1.5 |
CloudBees CD Plugin unconditionally disabled SSL/TLS certificate validation for the entire Jenkins controller JVM during the deployment/publication of an application.
CloudBees CD Plugin no longer does that. Instead, the existing opt-in option to ignore SSL/TLS errors is used during deployment for the specific connection.
This issue was caused by an incomplete fix for SECURITY-937.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free