{"id":"CVE-2018-1000149","details":"A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that disables host key verification by default.","aliases":["GHSA-322x-jv5h-cvjh"],"modified":"2026-07-08T12:28:37.688598Z","published":"2018-04-05T13:29:00.637Z","references":[{"type":"ADVISORY","url":"https://jenkins.io/security/advisory/2018-03-26/#SECURITY-630"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/ansible-plugin","events":[{"introduced":"0"},{"last_affected":"15b3016aa0a3ad63c36f9bb6da3905e530e6d7d0"}],"database_specific":{"cpe":"cpe:2.3:a:jenkins:ansible:*:*:*:*:*:jenkins:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"0.8"}],"source":"CPE_RANGE"}}],"versions":["ansible-0.8","ansible-0.7","ansible-0.6.2","ansible-0.6.1","ansible-0.6","ansible-0.5","ansible-0.4","ansible-0.3.1","ansible-0.3","ansible-0.2","ansible-0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000149.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}