PT-2022-19392 · Jenkins · Jenkins Google Compute Engine Plugin+1

Daniel Beck · Published 2022-04-12 · Updated 2023-12-22 · CVE-2022-29052

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Google Compute Engine Plugin versions 4.3.8 and earlier

Description The issue allows private keys to be stored unencrypted in cloud agent config.xml files on the Jenkins controller. This can be viewed by users with Agent/Extended Read permission or those with access to the Jenkins controller file system.

Recommendations For versions 4.3.8 and earlier, consider restricting access to the Jenkins controller file system and limiting Agent/Extended Read permissions to minimize the risk of exploitation. As a temporary workaround, restrict access to the config.xml files until a patch is available.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-29052

GHSA-VHXQ-9MPV-GJ87

Affected Products

Jenkins

Jenkins Google Compute Engine Plugin

References · 9

• https://jenkins.io/security/advisory/2022-04-12/#SECURITY-2045 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vhxq-9mpv-gj87 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29052 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29052 · Vendor Advisory
• https://github.com/jenkinsci/google-compute-engine-plugin/commit/16d2ae71a1b34c81db1d74f83c41577536e5256f · Note
• https://t.me/cvenotify/29236 · Telegram Post
• https://t.me/cvenotify/28794 · Telegram Post
• https://t.me/cibsecurity/40693 · Telegram Post
• https://t.me/cvenotify/64910 · Telegram Post