CVE-2020-2185

CVE-2020-2185 describes a vulnerability in Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier, where the plugin fails to validate SSH host keys during agent connections. This oversight enables potential man-in-the-middle attacks, allowing an attacker to intercept or alter communication between the Jenkins controller and EC2 agents. The vulnerability is rated Medium severity (CVSS 5.6), indicating a network-based attack with high attack complexity and potential for low impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.