CVE-2022-36881: Key Exchange without Entity Authentication

July 28, 2022 (updated August 10, 2022)

Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.

References

www.openwall.com/lists/oss-security/2022/07/27/1
github.com/advisories/GHSA-cm7j-p8hc-97vj
nvd.nist.gov/vuln/detail/CVE-2022-36881
www.jenkins.io/security/advisory/2022-07-27/

Detect and mitigate CVE-2022-36881 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →