CVE-2023-30516: Jenkins Image Tag Parameter Plugin improperly introduces option to opt out of SSL/TLS certificate validation

April 12, 2023

Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resulting in job configurations using Image Tag Parameters that were created before 2.0 having SSL/TLS certificate validation disabled by default.

References

github.com/advisories/GHSA-38jc-2rwx-qgxr
nvd.nist.gov/vuln/detail/CVE-2023-30516
www.jenkins.io/security/advisory/2023-04-12/

Code Behaviors & Features

Detect and mitigate CVE-2023-30516 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →