GHSA-g7fx-mmjc-r7gv

Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows decrypting secrets

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-23116

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.conjur.jenkins:conjur-credentials	< 1.0.10	1.0.10

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt secrets stored in Jenkins obtained through another method.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-23116 advisory
https://github.com/jenkinsci/conjur-credentials-plugin package
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2522%20(1) web
http://www.openwall.com/lists/oss-security/2022/01/12/6 web