CVE-2022-29052

2022-04-1220:15:09

Alpine Linux Development Team

security.alpinelinux.org

jenkins

google compute engine

private keys

unencrypted

config.xml files

extended read permission

file system

unix

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.0%

JSON

Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

OSVersionArchitecturePackageVersionFilename
Alpine3.15-communitynoarchjenkins= 2.319.3-r0UNKNOWN
Alpine3.16-communitynoarchjenkins= 2.346.2-r0UNKNOWN
Alpine3.17-communitynoarchjenkins= 2.361.2-r0UNKNOWN
Alpine3.18-communitynoarchjenkins= 2.387.3-r0UNKNOWN
Alpine3.19-communitynoarchjenkins= 2.440.3-r0UNKNOWN
Alpine3.20-communitynoarchjenkins= 2.440.2-r0UNKNOWN
Alpineedge-communitynoarchjenkins= 2.462.1-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	3.15-community	noarch	jenkins	= 2.319.3-r0	UNKNOWN
Alpine	3.16-community	noarch	jenkins	= 2.346.2-r0	UNKNOWN
Alpine	3.17-community	noarch	jenkins	= 2.361.2-r0	UNKNOWN
Alpine	3.18-community	noarch	jenkins	= 2.387.3-r0	UNKNOWN
Alpine	3.19-community	noarch	jenkins	= 2.440.3-r0	UNKNOWN
Alpine	3.20-community	noarch	jenkins	= 2.440.2-r0	UNKNOWN
Alpine	edge-community	noarch	jenkins	= 2.462.1-r0	UNKNOWN