~ / search / GHSA-xw4c-9434-3f7p

GHSA-xw4c-9434-3f7p

Jenkins Google Kubernetes Engine Plugin vulnerable to Exposure of Resource to Wrong Sphere

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10365

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:google-kubernetes-engine < 0.6.3 0.6.3

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file named `.kube…config` containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission. This temporary file is now created outside the regular project workspace.

References

External links from the advisory. They lead to third-party sites.