PT-2019-11760 · Jenkins · Jenkins Amazon Ec2 Plugin+1

Jesse Glick · Published 2019-07-31 · Updated 2023-10-25 · CVE-2019-10364

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Amazon EC2 Plugin versions 1.43 and earlier

Description The issue concerns the Jenkins Amazon EC2 Plugin, which wrote the beginning of private keys to the Jenkins system log. This could potentially expose sensitive information. The problem has been addressed, and the log message no longer includes the beginning of the private key.

Recommendations For Jenkins Amazon EC2 Plugin versions 1.43 and earlier, update to a version where the log message no longer includes the beginning of the private key to prevent potential exposure of sensitive information.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2019-10364

GHSA-W7FV-7J46-WWRV

Affected Products

Jenkins

Jenkins Amazon Ec2 Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-10364 · Security Note
• https://jenkins.io/security/advisory/2019-07-31/#SECURITY-673 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w7fv-7j46-wwrv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10364 · Vendor Advisory
• https://github.com/jenkinsci/ec2-plugin/commit/78c3c49a227ac8eccb8b1be7193d5605363fe251 · Note
• http://openwall.com/lists/oss-security/2019/07/31/1 · Note