Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin

보통 5.9CVE-2019-16546 · GHSA-345p-pw5q-g98v · Published 21/11/2019 · updated 17/06/2026

요약

CVE-2019-16546은(는) org.jenkins-ci.plugins:google-compute-engine, google compute engine (jenkins)에 영향을 주는 보통 (CVSS 5.9) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.87%, 전체 취약점의 58.8%보다 높음.
조치: 4.2.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:google-compute-engine Maven	`< 4.2.0`	`4.2.0`
google compute engine jenkins	`< 4.2.0`	`4.2.0`

Description

Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks. Google Compute Engine Plugin 4.2.0 verifies SSH host keys before executing any commands on agents.

NVD description

Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.

References

nvd.nist.gov/vuln/detail/CVE-2019-16546 · ADVISORY
jenkins.io/security/advisory/2019-11-21 · WEB
openwall.com/lists/oss-security/2019/11/21/1 · WEB

org.jenkins-ci.plugins:google-compute-engine의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:google-compute-engine

Maven

< 4.2.0

4.2.0

google compute engine

jenkins

< 4.2.0

4.2.0

Description

NVD description

Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.

org.jenkins-ci.plugins:google-compute-engine의 다른 취약점

모두 보기 →