CVE-2017-1000397

Vulnerability

Jenkins Maven Plugin versions 2.17 and earlier bundled a version of the commons-httpclient library that is affected by CVE-2012-6153. This vulnerability causes the library to incorrectly verify SSL certificates, making HTTPS connections susceptible to man-in-the-middle attacks. Maven Plugin 3.0 removes the dependency on commons-httpclient, resolving the issue [1].

Exploitation

An attacker with a position on the network path between the Jenkins server and a target HTTPS endpoint can exploit the flawed SSL certificate verification. The attacker must be able to intercept and modify network traffic (man-in-the-middle). No authentication or special permissions on the Jenkins system are required to trigger the vulnerable code path, as the library is used during normal Maven plugin operations that involve HTTPS connections.

Impact

Successful exploitation allows an attacker to intercept, decrypt, and potentially modify HTTPS traffic between the Jenkins Maven Plugin and remote services. This can lead to disclosure of sensitive information (such as credentials, source code, or build artifacts) and potentially allow the attacker to inject malicious content into the communication stream, compromising the integrity of the data [1].

Mitigation

Upgrade to Jenkins Maven Plugin 3.0 or later, which no longer depends on the vulnerable commons-httpclient library. No workaround is available for earlier versions. The fix was released on or before the advisory publication date of 2017-10-11 [2].