GitHub Advisoryadvisory · Maven

GHSA-wwgx-94v6-fc2p Jenkins SSH Agent Plugin exposes SSH private key password to users with permission to read the build log

LOW Published 2022-05-13 Modified 2022-12-12 Official page ↗
Aliases
CVE-2018-1999036
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:ssh-agent
Severity
Low
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-532
Reviewed
2022-12-12

Affected packages

• Maven org.jenkins-ci.plugins:ssh-agent: < 1.16 → fixed in 1.16

Description

An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH private key password to users with permission to read the build log. As of version 1.16, the plugin no longer logs the ssh-add invocation that would reveal the passphrase.

Related

Alias · CVE (1)

  • CVE-2018-1999036 An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References