CVE-2025-32754 – Jenkins SSH-Agent SSH Host Key Prediction

The following table lists the changes that have been made to the
CVE-2025-32754 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by [email protected]

    Apr. 10, 2025

    Action Type Old Value New Value
    Added Description In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
    Added Reference https://www.jenkins.io/security/advisory/2025-04-10/#SECURITY-3565
Share the Post:

Related Posts