Critical · published April 10, 2025
🚨 SSH host keys sharing? That's not how you secure a network! This vulnerability in jenkins/ssh-agent Docker images allows images based on Debian to generate identical SSH host keys, opening the door to impersonation attacks. 🔥 Think of SSH host keys as unique ID badges for workers on a construction site. If everyone has the same badge, anyone can pretend to be anyone else, leading to chaos on site—wrong decisions, lost materials, and ultimately, disaster. An attacker could easily insert themselves into the network path between the Jenkins controller and the SSH build agent, masquerading as the agent. This could result in unauthorized access, malicious commands, and a complete breach of your CI/CD pipeline! Absolutely devastating!
Think of SSH host keys as unique ID badges for workers on a construction site. If everyone has the same badge, anyone can pretend to be anyone else, leading to chaos on site—wrong decisions, lost materials, and ultimately, disaster. This flaw exists in jenkins/ssh-agent Docker images 6.11.1 and earlier, as the images generate SSH host keys during image creation, leading to identical keys across containers of the same version. This makes it possible for attackers to impersonate the SSH build agent.
An attacker could easily insert themselves into the network path between the Jenkins controller and the SSH build agent, masquerading as the agent. This could result in unauthorized access, malicious commands, and a complete breach of your CI/CD pipeline! Absolutely devastating! Upgrade to the latest jenkins/ssh-agent Docker image where this issue is fixed. Additionally, ensure that SSH host keys are generated independently for each container instance to enhance security. Regularly audit your SSH configurations! You've got this! Implement these fixes, and you'll be well on your way to securing your Jenkins environment. 🛡️