2 results · Feed
-
High 7.5
Agent-to-controller security bypass in Jenkins Debian Package Builder Plugin
Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path on the controller, allowing attackers able to control agent processes to invoke arbitrary OS comman…
-
Low 3.3
Credentials stored in plain text by debian-package-builder Plugin
Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.