CVE-2018-1000601: Exposure of Sensitive Information to an Unauthorized Actor
(updated )
A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.
References
- github.com/advisories/GHSA-cwcf-5m5w-mq2w
- github.com/jenkinsci/credentials-plugin/commit/23fbd6de33cc3cb74eafd44e7b27dd87b52c8904
- github.com/jenkinsci/ssh-credentials-plugin/commit/18b3121fa94a174064447d637dc11539e33b3a76
- github.com/jenkinsci/ssh-credentials-plugin/commits/ssh-credentials-1.14
- jenkins.io/security/advisory/2018-06-25/
- nvd.nist.gov/vuln/detail/CVE-2018-1000601
Code Behaviors & Features
Detect and mitigate CVE-2018-1000601 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →