1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-937

[JENKINS:SECURITY-937] ElectricFlow Plugin globally and unconditionally disabled SSL/TLS certificate validation

Severity Medium
Affected Packages 2
Fixed Packages 2
Info Packages References

ElectricFlow Plugin unconditionally disabled SSL/TLS certificate validation for the entire Jenkins controller JVM.

ElectricFlow Plugin 1.1.5 and newer no longer do that.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/electricflow <= 1.1.4
pkg:github/jenkinsci/electricflow-plugin <= 1.1.4
Package Fixed Version
pkg:maven/org.jenkins-ci.plugins/electricflow = 1.1.5
pkg:github/jenkinsci/electricflow-plugin = 1.1.5
ID
JENKINS:SECURITY-937
Severity
medium
Published
2019-02-19T00:00:00
(5 years ago)
Modified
2019-02-19T00:00:00
(5 years ago)
Rights
Jenkins Security Team
Source # ID Name URL
Plugin repository electricflow repository https://github.com/jenkinsci/electricflow-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/electricflow org.jenkins-ci.plugins electricflow <= 1.1.4
Fixed pkg:maven/org.jenkins-ci.plugins/electricflow org.jenkins-ci.plugins electricflow = 1.1.5
Affected pkg:github/jenkinsci/electricflow-plugin jenkinsci electricflow-plugin <= 1.1.4
Fixed pkg:github/jenkinsci/electricflow-plugin jenkinsci electricflow-plugin = 1.1.5