Flin-8

**Name of the Vulnerable Software and Affected Versions** Octopus Deploy versions 2020.3.x through 2020.3.3 Octopus Deploy versions 2020.4.x through 2020.4.0 **Description** The issue exposes an account password in cleartext in the verbose task logs output under certain circumstances. This occurs when an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker. **Recommendations** For Octopus Deploy versions 2020.3.x through 2020.3.3, update to version 2020.3.4 or later. For Octopus Deploy versions 2020.4.x through 2020.4.0, update to version 2020.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** Octopus Deploy versions 2018.8.4 through 2019.7.6 **Description** The issue allows an authenticated user, under specific circumstances involving special characters, to trigger a deployment that writes the web request proxy password to the deployment log in cleartext when a web request proxy is configured. **Recommendations** For versions 2018.8.4 through 2019.7.6, update to version 2019.7.7 or later to resolve the issue. For LTS versions, update to 2019.6.7 or 2019.3.8 to apply the back-ported fix.

**Name of the Vulnerable Software and Affected Versions** Octopus Tentacle versions 3.0.8 through 5.0.0 **Description** The issue allows an authenticated user, under specific circumstances involving OctopusPrintVariables, to trigger a deployment that writes the web request proxy password to the deployment log in cleartext when a web request proxy is configured. **Recommendations** For versions 3.0.8 through 4.0.6, update to version 4.0.7. For versions 4.0.7 through 5.0.0, update to version 5.0.1.