CVE-2023-30516 Jenkins Image Tag Parameter Plugin improperly introduces option to opt out of SSL/TLS certificate validation
MediumCVSS 6.5
EPSS 0.46%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resulting in job configurations using Image Tag Parameters that were created before 2.0 having SSL/TLS certificate validation disabled by default.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jenkins-ci.plugins/image-tag-parameter(Maven) | <= 2.0 | No fix listed |
| org.jenkins-ci.plugins/image-tag-parameter(Maven) | = 1.1.1 | No fix listed |
| org.jenkins-ci.plugins/image-tag-parameter(Maven) | = 1.10 | No fix listed |
| org.jenkins-ci.plugins/image-tag-parameter(Maven) | = 1.2 | No fix listed |
| org.jenkins-ci.plugins/image-tag-parameter(Maven) | = 1.3 | No fix listed |
| org.jenkins-ci.plugins/image-tag-parameter(Maven) | = 1.4 | No fix listed |
| org.jenkins-ci.plugins/image-tag-parameter(Maven) | = 1.5 | No fix listed |
| org.jenkins-ci.plugins/image-tag-parameter(Maven) | = 1.6 | No fix listed |
| org.jenkins-ci.plugins/image-tag-parameter(Maven) | = 1.7 | No fix listed |
| org.jenkins-ci.plugins/image-tag-parameter(Maven) | = 1.8 | No fix listed |
| org.jenkins-ci.plugins/image-tag-parameter(Maven) | = 1.8.1 | No fix listed |
| org.jenkins-ci.plugins/image-tag-parameter(Maven) | = 1.8.2 | No fix listed |
| org.jenkins-ci.plugins/image-tag-parameter(Maven) | = 1.9 | No fix listed |
| org.jenkins-ci.plugins/image-tag-parameter(Maven) | = 2.0 | No fix listed |
| Jenkins Project Jenkins Image Tag Parameter Plugin | <= 2.0 | No fix listed |
| jenkins image tag parameter | < 2.0 | 2.0 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- Jenkins Security Advisory 2023-04-12 vendor-advisory
- www.openwall.com mailing-list third-party-advisory
- github.com