-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing hostname validation during SMTP TLS handshakes. The commit e1893c6 shows the fix explicitly adds 'mail.smtp.ssl.checkserveridentity=true' property in Mailer.java's createSession method. Prior versions lacked this security check, making the session establishment function vulnerable. The function's responsibility for configuring mail session properties directly relates to the certificate validation mechanism described in the CVE.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:mailer | maven | = 1.32 | 1.32.1 |
| org.jenkins-ci.plugins:mailer | maven | >= 1.30, < 1.31.1 | 1.31.1 |
| org.jenkins-ci.plugins:mailer | maven | < 1.29.1 | 1.29.1 |
Ongoing coverage of React2Shell