Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows decrypting secrets

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-23116 · ADVISORY
• jenkinsci/conjur-credentials-plugin · PACKAGE
• jenkins.io/security/advisory/2022-01-12 · WEB
• openwall.com/lists/oss-security/2022/01/12/6 · WEB
• jenkins.io/security/advisory/2022-01-12 · Vendor Advisory

org.conjur.jenkins:conjur-credentials のその他の脆弱性

• CVE-2022-25190中 4.3A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate cr…
• CVE-2022-23117高 7.5Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve a…