PT-2018-9396 · Jenkins · Jenkins Aws Codedeploy Plugin+1

Oleg Nenashev · Publicado 2018-07-09 · Atualizado 2022-05-14 · CVE-2018-1000402

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins AWS CodeDeploy Plugin versions 1.19 and earlier

Description The issue is related to a File and Directory Information Exposure that can result in the disclosure of environment variables. This is due to a vulnerability in the AWSCodeDeployPublisher.java file.

Recommendations For Jenkins AWS CodeDeploy Plugin versions 1.19 and earlier, update to version 1.20 or later to resolve the issue.

Correção

Insufficiently Protected Credentials

Information Disclosure

Enumeração de Fraquezas

CWE-522

CWE-200

Identificadores relacionados

CVE-2018-1000402

GHSA-644J-JCC4-CRX7

Produtos afetados

Jenkins

Jenkins Aws Codedeploy Plugin

Referências · 6

• https://github.com/jenkinsci/aws-codedeploy-plugin/commit/4bef70636dbcb9e773d4a4a6186726719cb88ee4 · Nota
• https://github.com/jenkinsci/aws-codedeploy-plugin/commit/a086092ddf79d0b232e44f5908e8b6ef3dfcde9d · Nota
• https://jenkins.io/security/advisory/2018-06-25/#SECURITY-825 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-644j-jcc4-crx7 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000402 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000402 · Nota de Segurança