GitHub Advisoryadvisory · Maven

GHSA-5gmf-8gh2-hhfp Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext

CRITICAL Published 2022-05-13 Modified 2022-11-22 Official page ↗
Aliases
CVE-2017-1000245
Ecosystem
Maven
Packages
org.jvnet.hudson.plugins:ssh, org.jenkins-ci.plugins:ssh
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-522
Reviewed
2022-11-22

Affected packages

• Maven org.jvnet.hudson.plugins:ssh: <= 2.3 (no fix yet) • Maven org.jenkins-ci.plugins:ssh: < 2.5 → fixed in 2.5

Description

The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file.

Related

Alias · CVE (1)

  • CVE-2017-1000245 The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References