SSH Host Key Verification Bypass in Jenkins Git Client Plugin

CVE-2022-36881

Summary

The Jenkins Git Client Plugin prior to version 3.11.0 lacks SSH host key verification when establishing connections to Git repositories via SSH. This security oversight makes it possible for attackers to execute man-in-the-middle attacks, thereby potentially intercepting or manipulating data transmitted between Jenkins and the target Git repository. Proper host key verification is crucial to ensure the authenticity of the repository and prevent unauthorized access, making it essential for users of affected versions to upgrade to mitigate this risk.

References