What is GHSA-5jc5-m87x-88fj?

GHSA-5jc5-m87x-88fj is a security advisory published by GitHub Security Advisories with Low severity. Secret displayed without masking by Chef Identity Plugin

Which CVE IDs does GHSA-5jc5-m87x-88fj cover?

GHSA-5jc5-m87x-88fj covers the following CVE IDs: CVE-2023-39155. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5jc5-m87x-88fj?

GHSA-5jc5-m87x-88fj has a CVSS v3 base score of 3.1, published by GitHub Security Advisories.

Which products are affected by GHSA-5jc5-m87x-88fj?

GHSA-5jc5-m87x-88fj affects 1 product, including: maven/org.jenkins-ci.plugins:chef-identity:\u003c= 2.0.3.

GHSA-5jc5-m87x-88fjLowCVSS 3.1

Secret displayed without masking by Chef Identity Plugin

Vendor

GitHub Security Advisories

Published

July 26, 2023

Last Modified

November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-39155 →

📋 Description

Chef Identity Plugin stores the user.pem key in its global configuration file io.chef.jenkins.ChefIdentityBuildWrapper.xml on the Jenkins controller as part of its configuration.

While this key is stored encrypted on disk, in Chef Identity Plugin 2.0.3 and earlier the global configuration form does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it.

🎯 Affected products1

maven/org.jenkins-ci.plugins:chef-identity:<= 2.0.3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-39155
https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3192
http://www.openwall.com/lists/oss-security/2023/07/26/2
https://github.com/advisories/GHSA-5jc5-m87x-88fj