PT-2018-15215 · Jenkins · Jenkins Ssh Agent Plugin+1

Jan Hollevoet · Published 2018-08-01 · Updated 2022-05-13 · CVE-2018-1999036

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins SSH Agent Plugin versions 1.15 and earlier

Description An exposure of sensitive information issue exists in the Jenkins SSH Agent Plugin that exposes the SSH private key password to users with permission to read the build log. This occurs due to the logging of the ssh-add invocation in the SSHAgentStepExecution.java file, which reveals the passphrase.

Recommendations For Jenkins SSH Agent Plugin versions 1.15 and earlier, update to version 1.16 or later, as it no longer logs the ssh-add invocation that would reveal the passphrase.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2018-1999036

GHSA-WWGX-94V6-FC2P

Affected Products

Jenkins

Jenkins Ssh Agent Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-wwgx-94v6-fc2p · Vendor Advisory
• https://jenkins.io/security/advisory/2018-07-30/#SECURITY-704 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999036 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1999036 · Vendor Advisory
• https://github.com/jenkinsci/ssh-agent-plugin/commit/3a8abe1889d25f9a73cdba202cf27212b273de4d · Note
• https://github.com/jenkinsci/ssh-agent-plugin · Note