CVE-2020-2187

描述

Amazon EC2 Plugin connects to Windows agents via HTTPS. Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed HTTPS certificates and does not perform hostname validation when connecting to Windows agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents. Amazon EC2 Plugin 1.50.2 by default no longer accepts self-signed HTTPS certificates and performs hostname validation. A new configuration option allows restoring the previous, unsafe behavior. For more information see [the plugin documentation](https://github.com/jenkinsci/ec2-plugin/#securing-the-connection-to-windows-amis).

如何修補 CVE-2020-2187

要修補 CVE-2020-2187,請將受影響套件升級到下列已修補版本。

• —升級至 1.50.2 或更新版本

CVE-2020-2187 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.50.2

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-2187
• PATCHgithub.com/jenkinsci/ec2-plugin
• WEBwww.openwall.com/lists/oss-security/2020/05/06/3
• WEBgithub.com/jenkinsci/ec2-plugin/commit/4c9f03ae202e4730fd54eda40771fa4d3873e358