PT-2022-10053 · Unknown · Windows Tentacle

Published 2022-01-19 · Updated 2022-01-26 · CVE-2021-31821

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows Tentacle docker image (affected versions not specified)

Description The issue concerns the logging of commands and their arguments when the Windows Tentacle docker image starts up. This results in the Octopus Server API key being written in plaintext. The Linux Docker image is not affected by this issue.

Recommendations For the Windows Tentacle docker image, consider disabling the logging of commands and their arguments as a temporary workaround until a patch is available. Restrict access to the log files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-31821

Affected Products

Windows Tentacle

References · 4

• https://osv.dev/vulnerability/CVE-2021-31821 · Vendor Advisory
• https://advisories.octopus.com/post/2022/sa2022-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31821 · Security Note
• https://t.me/cibsecurity/35775 · Telegram Post