PT-2018-15215 · Jenkins · Jenkins Ssh Agent Plugin+1

Jan Hollevoet · Publicado 2018-08-01 · Atualizado 2022-05-13 · CVE-2018-1999036

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins SSH Agent Plugin versions 1.15 and earlier

Description An exposure of sensitive information issue exists in the Jenkins SSH Agent Plugin that exposes the SSH private key password to users with permission to read the build log. This occurs due to the logging of the ssh-add invocation in the SSHAgentStepExecution.java file, which reveals the passphrase.

Recommendations For Jenkins SSH Agent Plugin versions 1.15 and earlier, update to version 1.16 or later, as it no longer logs the ssh-add invocation that would reveal the passphrase.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2018-1999036

GHSA-WWGX-94V6-FC2P

Produtos afetados

Jenkins

Jenkins Ssh Agent Plugin

Referências · 6

• https://github.com/jenkinsci/ssh-agent-plugin/commit/3a8abe1889d25f9a73cdba202cf27212b273de4d · Nota
• https://github.com/jenkinsci/ssh-agent-plugin · Nota
• https://osv.dev/vulnerability/GHSA-wwgx-94v6-fc2p · Aviso do Fabricante
• https://jenkins.io/security/advisory/2018-07-30/#SECURITY-704 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999036 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1999036 · Aviso do Fabricante