CVE-2022-36881
Jenkins Git client plugin 3.11.0 does not perform SSH host key verification
Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.
- Record
CVE-2022-36881- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.
- Record
CVE-2022-36881- Updated
- 2026-11-02
EUVDEUVD-2022-6320 No score
Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.
- Record
EUVD-2022-6320- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cm7j-p8hc-97vj
Jenkins Git client plugin 3.11.0 does not perform SSH host key verification
Jenkins Git client plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Git client Plugin 3.11.1 provides strategies for performing host key verification for administrators to select the one that meets their security needs. For more information see the plugin documentation.
- Record
GHSA-cm7j-p8hc-97vj- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-295, CWE-322
- Updated
- 2026-11-02
OSV
Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.
- Record
CVE-2022-36881- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-cm7j-p8hc-97vj
Jenkins Git client plugin 3.11.0 does not perform SSH host key verification
Jenkins Git client plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Git client Plugin 3.11.1 provides strategies for performing host key verification for administrators to select the one that meets their security needs. For more information see the plugin documentation.
- Record
GHSA-cm7j-p8hc-97vj- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-295, CWE-322
- Updated
- 2026-11-02
OSVRHBA-2022:8582
Red Hat Bug Fix Advisory: OpenShift Container Platform 4.9.52 packages update
- Record
RHBA-2022:8582- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2022:7865
Red Hat Security Advisory: OpenShift Container Platform 4.10.41 security update
- Record
RHSA-2022:7865- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:0017
Red Hat Security Advisory: OpenShift Container Platform 4.8.56 packages and security update
- Record
RHSA-2023:0017- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:git-clientMaven |
through 3.11.0 | 3.11.1 |
org.jenkins-ci.plugins:git-clientMaven |
before 3.11.1, plus listed versions 1.0.21.0.31.0.41.0.51.0.6 Show 45 moreShow less1.0.71.11.1.11.1.21.10.01.10.11.10.21.11.01.11.11.12.01.13.01.14.01.14.11.15.01.16.11.17.01.17.11.18.01.19.01.19.11.19.21.19.31.19.41.19.51.19.61.19.71.2.01.20.0-beta11.20.0-beta21.20.0-beta31.20.21.21.01.3.01.4.01.4.11.4.21.4.31.4.41.4.51.4.61.5.01.5.11.6.01.6.11.6.2 |
3.11.1 |
jenkins-2-pluginsRed Hat:openshift:4.9::el8 From an advisory covering 2 CVEs |
before 0:4.9.1667460322-1.el8 | 0:4.9.1667460322-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.10::el8 |
before 0:4.10.1667388055-1.el8 | 0:4.10.1667388055-1.el8 |
jenkinsRed Hat:openshift:4.8::el8 From an advisory covering 16 CVEs |
before 0:2.361.1.1672840472-1.el8 | 0:2.361.1.1672840472-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.8::el8 From an advisory covering 16 CVEs |
before 0:4.8.1672842762-1.el8 | 0:4.8.1672842762-1.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-36881 is a high vulnerability (CVSS 8.1) in Jenkins Git Client, published July 27, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 63rd percentile. Fixed in org.jenkins-ci.plugins:git-client 3.11.1.
References
jenkins.io/security/advisory/2022-07-27
openwall.com/lists/oss-security/2022/07/27/1
nvd.nist.gov/vuln/detail/CVE-2022-36881
github.com/jenkinsci/git-client-plugin/commit/88f52c6c9b18bca4ad210e3b9910a49433583fd9
Show 75 moreShow less
access.redhat.com/errata/RHBA-2022:8582
issues.redhat.com/browse/OCPBUGS-3983
security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_8582.json
bugzilla.redhat.com/show_bug.cgi?id=2103548
cve.org/CVERecord?id=CVE-2022-34176
Left out here: 84 versions. The JSON record has them.