CVE-2019-16546 — Jenkins project / Jenkins Google Compute Engine Plugin

CVE-2019-16546

Jenkins project / Jenkins Google Compute Engine Plugin PUBLISHED

Description (CNA)

Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.

Affected (CNA)

Vendor / product	Versions
Jenkins project / Jenkins Google Compute Engine Plugin	affected 4.1.1 and earlier

CWE

No CWE identifiers supplied.

References

https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1584
http://www.openwall.com/lists/oss-security/2019/11/21/1

ADP enrichment

CVE

No English description supplied.

https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1584
http://www.openwall.com/lists/oss-security/2019/11/21/1