GHSA-vhxq-9mpv-gj87
Private key stored in plain text by Jenkins Google Compute Engine Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:google-compute-engine | < 4.3.9 | 4.3.9 |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent `config.xml` files on the Jenkins controller where they can be viewed by users with Agent/Extended Read permission, or access to the Jenkins controller file system.
References
External links from the advisory. They lead to third-party sites.