medium4.3
CVE-2022-29052
Private key stored in plain text by Jenkins Google Compute Engine Plugin
Impact
Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent `config.xml` files on the Jenkins controller where they can be viewed by users with Agent/Extended Read permission, or access to the Jenkins controller file system.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:google-compute-engine | < 4.3.9 | 4.3.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Google Compute Engine | through 4.3.8 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2045
- https://github.com/advisories/GHSA-vhxq-9mpv-gj87
- https://nvd.nist.gov/vuln/detail/CVE-2022-29052
- https://github.com/jenkinsci/google-compute-engine-plugin/commit/16d2ae71a1b34c81db1d74f83c41577536e5256f