CVE-2018-1000403: AWS CodeDeploy Plugin stored AWS Secret Key in plain text
Summary
CVE-2018-1000403: AWS CodeDeploy Plugin stored AWS Secret Key in plain text. Affects com.amazonaws:codedeploy versions < 1.20. Fixed in 1.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AWS CodeDeploy Plugin is a component of the Jenkins project that allows users to deploy applications to Amazon Web Services (AWS) CodeDeploy. It provides integration with AWS services and facilitates the deployment process. The plugin version 1.19 and earlier had a vulnerability that resulted in the storage of the AWS Secret Key in plain text. This vulnerability could be exploited through local file access.
Vulnerability Detail
The vulnerability in the AWS CodeDeploy Plugin (version 1.19 and earlier) allowed for the disclosure of credentials due to insufficient protection. The AWS Secret Key was stored in plain text in the configuration files on disk. This meant that anyone with access to the files could potentially obtain the AWS Secret Key and gain unauthorized access to AWS resources. The vulnerability was addressed in version 1.20 and newer, which now encrypts the AWS Secret Key in the configuration files and no longer transfers it in plain text to users viewing the configuration form.
How To Fix
Minimum fixed version
1.20
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The AWS CodeDeploy Plugin (version 1.19 and earlier) had a vulnerability that allowed for the disclosure of the AWS Secret Key. This could potentially lead to unauthorized access to AWS resources and data breaches. Users should upgrade to version 1.20 or newer of the plugin to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for com.amazonaws:codedeploy →
FAQ
The vulnerability allowed for the disclosure of the AWS Secret Key, which could lead to unauthorized access to AWS resources and potential data breaches.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
There is no specific workaround for this vulnerability. Upgrading to version 1.20 or newer of the AWS CodeDeploy Plugin is the recommended solution.
There are no known exploits for this vulnerability at the moment.
You can find more information about this vulnerability in the GitHub advisory database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-h66p-m766-33fv/GHSA-h66p-m766-33fv.json).
References
Related vulnerabilities
Recent vulnerabilities recorded for com.amazonaws:codedeploy.
