~ / search / GHSA-fh5w-p2j4-4p8x

GHSA-fh5w-p2j4-4p8x

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2307

Packages

EcosystemPackageAffectedFixed in
Maven org.csanchez.jenkins.plugins:kubernetes >= 1.27.0, < 1.27.4 1.27.4
Maven org.csanchez.jenkins.plugins:kubernetes >= 1.26.0, < 1.26.5 1.26.5
Maven org.csanchez.jenkins.plugins:kubernetes >= 1.22.0, < 1.25.4.1 1.25.4.1
Maven org.csanchez.jenkins.plugins:kubernetes < 1.21.6 1.21.6

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Kubernetes Plugin prior to 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 includes a feature to replace placeholders in pod template and container template fields with environment variable values. This feature allows low-privilege users to access possibly sensitive Jenkins controller environment variables. Kubernetes Plugin 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 disables this feature.

References

External links from the advisory. They lead to third-party sites.