Jenkins SSH-Slave Docker Images Host Key Reuse Vulnerability

A vulnerability exists in Jenkins SSH-Slave Docker images based on Debian, where SSH host keys are generated during image creation. This leads to all containers from the same image version using identical SSH host keys. Consequently, an attacker who can intercept the network path between the SSH client and the SSH build agent can impersonate the agent. This issue affects Jenkins SSH-Slave images up to and including all versions.

Impact

Exploitation of this vulnerability allows for impersonation of the SSH build agent, potentially leading to unauthorized actions or access during the build process.

Remediation

Users of Jenkins SSH-Slave Docker images should switch to the Jenkins SSH-Agent Docker images, which are actively maintained. The SSH-Agent images version 6.11.2 and later include the necessary fix. For those already using Jenkins SSH-Agent, ensure the version is 6.11.2 or later.