CVE-2023-32994: Jenkins SAML Single Sign On(SSO) Plugin unconditionally disables SSL/TLS certificate validation

May 16, 2023 (updated May 17, 2023)

Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.

References

github.com/advisories/GHSA-9m92-qwpc-qm78
nvd.nist.gov/vuln/detail/CVE-2023-32994
www.jenkins.io/security/advisory/2023-05-16/

Code Behaviors & Features

Detect and mitigate CVE-2023-32994 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →