{"id":"CVE-2019-10444","aliases":["EUVD-2022-4971","GHSA-qgp8-h5cp-r75r"],"status":"published","title":"Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation","description":"Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00799,"percentile":0.56809,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2019-10-16T13:00:47Z","modified":"2026-10-24T10:30:22Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:bumblebee","fixed_in":["4.1.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:bumblebee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.3"},{"fixed":"4.1.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:bumblebee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.4"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.1.0","4.1.1","4.1.2","4.1.3"]}],"products":[{"vendor":"jenkins","product":"bumblebee_hp_alm"},{"vendor":"jenkins project","product":"jenkins bumblebee hp alm plugin"}],"references":[{"url":"https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1481","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10444","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qgp8-h5cp-r75r"}],"sources":{"cve":[{"id":"CVE-2019-10444","description":"Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.","status":"published","published":"2019-10-16T13:00:47Z","modified":"2024-08-04T22:24:18.234Z","updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2022-4971","description":"Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.","status":"published","published":"2019-10-16T13:00:47Z","modified":"2024-08-04T22:24:18Z","updated_at":"2026-11-03T02:40:51.633398Z"}],"ghsa":[{"id":"GHSA-qgp8-h5cp-r75r","title":"Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation","description":"Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation for connections to the HP ALM service.\n\nBumblebee HP ALM Plugin no longer does that. Instead, it now allows users to opt out of certificate validation.","status":"published","published":"2022-05-24T16:58:49Z","modified":"2023-10-26T23:06:15Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:37:10.053831Z"}],"nvd":[{"id":"CVE-2019-10444","description":"Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.","status":"published","published":"2019-10-16T14:15:12.447Z","modified":"2026-06-17T02:10:57.133Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:05:31.860711Z"}],"osv":[{"id":"CVE-2019-10444","description":"Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.","status":"published","published":"2019-10-16T14:15:12.447Z","modified":"2026-10-24T10:30:22.823360796Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-qgp8-h5cp-r75r","title":"Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation","description":"Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation for connections to the HP ALM service.\n\nBumblebee HP ALM Plugin no longer does that. Instead, it now allows users to opt out of certificate validation.","status":"published","published":"2022-05-24T16:58:49Z","modified":"2024-02-16T08:21:11.289991Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:54.40888Z"}]}}