PT-2022-15859 · Jenkins · Jenkins Conjur Secrets Plugin+1

Daniel Beck · Published 2022-01-12 · Updated 2023-11-30 · CVE-2022-23116

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Conjur Secrets Plugin versions 1.0.9 and earlier

Description The issue allows attackers who can control agent processes to decrypt secrets stored in Jenkins, which were obtained through another method. This is possible due to the implementation of certain functionality in the plugin.

Recommendations For Jenkins Conjur Secrets Plugin versions 1.0.9 and earlier, update to a version later than 1.0.9 to resolve the issue. As a temporary workaround, consider restricting access to agent processes to minimize the risk of exploitation.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2022-23116

GHSA-G7FX-MMJC-R7GV

Affected Products

Jenkins

Jenkins Conjur Secrets Plugin

References · 10

• https://jenkins.io/security/advisory/2022-01-12/#SECURITY-2522%20%281%29 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23116 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23116 · Security Note
• https://osv.dev/vulnerability/GHSA-g7fx-mmjc-r7gv · Vendor Advisory
• https://github.com/jenkinsci/conjur-credentials-plugin · Note
• https://t.me/cvenotify/61758 · Telegram Post
• https://t.me/cibsecurity/35356 · Telegram Post
• https://jenkins.io/security/advisory/2022-01-12/#SECURITY-2522%20(1) · Note
• https://t.me/cvenotify/25345 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/12/6 · Note