GHSA-5gmf-8gh2-hhfpCriticalCVSS 9.8

Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext

Published
May 13, 2022
Last Modified
February 2, 2023

🔗 CVE IDs covered (1)

CVE-2017-1000245 →

📋 Description

The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file.

🎯 Affected products2

  • maven/org.jvnet.hudson.plugins:ssh:<= 2.3
  • maven/org.jenkins-ci.plugins:ssh:< 2.5

🔗 References (3)