Description

Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it.

Remediation

References

http://www.openwall.com/lists/oss-security/2023/07/26/2

https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3192

Related Vulnerabilities

CVE-2019-10062 Vulnerability in npm package aurelia-framework

CVE-2020-36181 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2020-13445 Vulnerability in maven package com.liferay:com.liferay.portal.template.freemarker

CVE-2019-16728 Vulnerability in npm package dompurify

CVE-2021-23363 Vulnerability in npm package kill-by-port

Severity

Medium

Classification

CWE-668 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory