GHSA-vhxq-9mpv-gj87

ghsaUSosv

Private key stored in plain text by Jenkins Google Compute Engine Plugin

view advisory published 2022-04-13Licence: CC-BY-4.0

Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent `config.xml` files on the Jenkins controller where they can be viewed by users with Agent/Extended Read permission, or access to the Jenkins controller file system.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-29052US	medium4.3	0.75% (55th)	—	2022-04-12
Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users w…

references

External citations — patches, advisories, analysis.

https://github.com/jenkinsci/google-compute-engine-plugin/commit/16d2ae71a1b34c81db1d74f83c41577536e5256fWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-29052ADVISORY
https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2045WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan