GitHub Advisoryadvisory · Maven

GHSA-5jc5-m87x-88fj Secret displayed without masking by Chef Identity Plugin

LOW Published 2023-07-26 Modified 2023-08-01 Official page ↗
Aliases
CVE-2023-39155
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:chef-identity
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-668
Reviewed
2023-07-26

Affected packages

• Maven org.jenkins-ci.plugins:chef-identity: <= 2.0.3 (no fix yet)

Description

Chef Identity Plugin stores the user.pem key in its global configuration file `io.chef.jenkins.ChefIdentityBuildWrapper.xml` on the Jenkins controller as part of its configuration. While this key is stored encrypted on disk, in Chef Identity Plugin 2.0.3 and earlier the global configuration form does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it.

Related

Alias · CVE (1)

  • CVE-2023-39155 Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References