CVE-2025-32755 – Jenkins SSH Slave Debian Host Key Spoofing Vulnerability

The following table lists the changes that have been made to the
CVE-2025-32755 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by [email protected]

    Apr. 10, 2025

    Action Type Old Value New Value
    Added Tag unsupported-when-assigned
    Added Description In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
    Added Reference https://www.jenkins.io/security/advisory/2025-04-10/#SECURITY-3565
Share the Post:

Related Posts