CVE-2022-29052 Private key stored in plain text by Jenkins Google Compute Engine Plugin

What is CVE-2022-29052?

CVE-2022-29052 is a medium-severity vulnerability in Jenkins Google Compute Engine Plugin, published on 12 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Weakness: CWE-522

Which versions are affected by CVE-2022-29052?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:google-compute-engine. It affects 1 product.

Products include Jenkins Google Compute Engine.

How do I fix CVE-2022-29052?

Upgrade org.jenkins-ci.plugins:google-compute-engine to 4.3.9 or later.

Is CVE-2022-29052 being exploited?

There is no known exploitation of CVE-2022-29052 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Google Compute Engine Plugin

• CVE-2023-49673 Jenkins NeuVector Vulnerability Scanner Plugin Cross-Site Request Forgery vulnerability High 8.8
• CVE-2019-16548 Jenkins Google Compute Engine Plugin Cross-Site Request Forgery vulnerability High 8.8
• CVE-2019-16546 Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin Medium 5.9
• CVE-2019-16547 Jenkins Google Compute Engine Plugin Missing Authorization vulnerability Medium 4.3
• CVE-2023-49652 Jenkins Google Compute Engine Plugin has incorrect permission checks Low 2.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vhxq-9mpv-gj87.