CVE-2025-47888: Jenkins DingTalk Plugin Unconditionally Disables SSL/TLS Certificate and Hostname Validation

May 14, 2025 (updated May 16, 2025)

Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks.

References

github.com/advisories/GHSA-cp9r-g575-xc5f
github.com/jenkinsci/dingtalk-plugin
nvd.nist.gov/vuln/detail/CVE-2025-47888
www.jenkins.io/security/advisory/2025-05-14/

Code Behaviors & Features

Detect and mitigate CVE-2025-47888 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →