PT-2020-15740 · Octopus · Octopus Deploy

Flin-8 · Published 2020-09-09 · Updated 2020-09-10 · CVE-2020-24566

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 2020.3.x through 2020.3.3 Octopus Deploy versions 2020.4.x through 2020.4.0

Description The issue exposes an account password in cleartext in the verbose task logs output under certain circumstances. This occurs when an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker.

Recommendations For Octopus Deploy versions 2020.3.x through 2020.3.3, update to version 2020.3.4 or later. For Octopus Deploy versions 2020.4.x through 2020.4.0, update to version 2020.4.1 or later.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2020-24566

Affected Products

Octopus Deploy

References · 4

• https://osv.dev/vulnerability/CVE-2020-24566 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24566 · Security Note
• https://github.com/OctopusDeploy/Issues/issues/6564 · Note
• https://github.com/OctopusDeploy/Issues/issues/6563 · Note