CVE-2022-28142: Improper Certificate Validation

March 30, 2022 (updated November 29, 2022)

Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to ignore SSL/TLS issues.

References

www.openwall.com/lists/oss-security/2022/03/29/1
github.com/advisories/GHSA-fhhx-r983-44xc
nvd.nist.gov/vuln/detail/CVE-2022-28142
www.jenkins.io/security/advisory/2022-03-29/

Code Behaviors & Features

Detect and mitigate CVE-2022-28142 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →