[org.jenkins-ci.plugins:ansible] Jenkins Ansible Plugin man in the middle vulnerability

A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that disables host key verification by default. Ansible Plugin 1.0 now enables host key verification by default, adding options allowing users to opt out.

References

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000149
• https://jenkins.io/security/advisory/2018-03-26/#SECURITY-630
• https://github.com/advisories/GHSA-322x-jv5h-cvjh