CVE-2018-1999036: Jenkins SSH Agent Plugin exposes SSH private key password
Summary
CVE-2018-1999036: An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH private key password to users with permission to read the build lo... Affects org.jenkins-ci.plugins:ssh-agent versions < 1.16. Fixed in 1.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins SSH Agent Plugin is a Maven package (org.jenkins-ci.plugins:ssh-agent) that provides functionality for managing SSH private keys in Jenkins. It allows users to securely use SSH keys for authentication in Jenkins pipelines and jobs. The plugin integrates with the SSH Agent feature of Jenkins, which enables the use of SSH keys without exposing them in plain text. However, a vulnerability in versions 1.15 and earlier of the plugin exposes the SSH private key password to users with permission to read the build log.
Vulnerability Detail
The vulnerability (CVE-2018-1999036) in the Jenkins SSH Agent Plugin allows users with permission to read the build log to access the SSH private key password. This sensitive information exposure occurs due to a flaw in the SSHAgentStepExecution.java file. Prior to version 1.16, the plugin logged the ssh-add invocation, which revealed the passphrase. An attacker with access to the build log could obtain the SSH private key password and potentially gain unauthorized access to systems or sensitive information.
How To Fix
Minimum fixed version
1.16
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can consider restricting access to the build log by adjusting the permissions of the Jenkins instance. By limiting the number of users with permission to read the build log, the risk of exposing the SSH private key password can be reduced.
Conclusion
The Jenkins SSH Agent Plugin vulnerability (CVE-2018-1999036) exposes the SSH private key password to users with permission to read the build log. To mitigate this vulnerability, it is crucial to upgrade to version 1.16 or later of the plugin. Restricting access to the build log can also help reduce the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ssh-agent →
FAQ
The vulnerability allows users with permission to read the build log to obtain the SSH private key password. This can lead to unauthorized access to systems or sensitive information.
Versions 1.15 and earlier of the Jenkins SSH Agent Plugin are affected by this vulnerability.
Yes, the vulnerability has been fixed in version 1.16 of the Jenkins SSH Agent Plugin.
There are no known exploits for this vulnerability at the moment.
While upgrading to the latest version is the recommended solution, you can also reduce the risk by limiting the number of users with permission to read the build log.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ssh-agent.
