CVE-2017-1000362: Information Exposure

July 17, 2017 (updated July 26, 2017)

The re-key admin monitor in Jenkins re-encrypts all secrets in JENKINS_HOME with a new key. It also created a backup directory with all old secrets, and the key used to encrypt them. These backups are world-readable and not removed.

References

jenkins.io/security/advisory/2017-02-01/
nvd.nist.gov/vuln/detail/CVE-2017-1000362

Code Behaviors & Features

Detect and mitigate CVE-2017-1000362 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →