Jenkins SSH Agent Plugin exposes SSH private key password to users with permission to read the build log
Low severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Dec 15, 2023
Description
Published by the National Vulnerability Database
Aug 1, 2018
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Dec 12, 2022
Last updated
Dec 15, 2023
An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH private key password to users with permission to read the build log. As of version 1.16, the plugin no longer logs the ssh-add invocation that would reveal the passphrase.
References