What is GHSA-vhxq-9mpv-gj87?

GHSA-vhxq-9mpv-gj87 is a security advisory published by GitHub Security Advisories with Medium severity. Private key stored in plain text by Jenkins Google Compute Engine Plugin

Which CVE IDs does GHSA-vhxq-9mpv-gj87 cover?

GHSA-vhxq-9mpv-gj87 covers the following CVE IDs: CVE-2022-29052. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vhxq-9mpv-gj87?

GHSA-vhxq-9mpv-gj87 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-vhxq-9mpv-gj87?

GHSA-vhxq-9mpv-gj87 affects 1 product, including: maven/org.jenkins-ci.plugins:google-compute-engine:\u003c 4.3.9.

GHSA-vhxq-9mpv-gj87MediumCVSS 4.3

Private key stored in plain text by Jenkins Google Compute Engine Plugin

Vendor

GitHub Security Advisories

Published

April 13, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-29052 →

📋 Description

Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Agent/Extended Read permission, or access to the Jenkins controller file system.

🎯 Affected products1

maven/org.jenkins-ci.plugins:google-compute-engine:< 4.3.9

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-29052
https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2045
https://github.com/jenkinsci/google-compute-engine-plugin/commit/16d2ae71a1b34c81db1d74f83c41577536e5256f
https://github.com/advisories/GHSA-vhxq-9mpv-gj87