PT-2023-22743 · Jenkins · Jenkins Azure Key Vault Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Azure Key Vault Plugin versions 187.va cd5fecd198a and earlier Description: The issue arises when the push mode for durable task logging is enabled, causing the plugin to not properly mask credentials in the build log. This means that...

Jenkins Plugin Azure Key Vault 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

This Week in Spring - April 11th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this I am in Amsterdam, Netherlands, preparing to speak at the Utrecht JUG tonight along with fellow Java Champion Trisha Gee. We're not speaking together, but instead it's a double header: she'll speak first, then...

Defense-in-Depth Updates for Azure Identity libraries and Azure Key Vault libraries within Azure SDK plus Best Practice Implementation Guidance

Summary Today, Microsoft released new versions of the Azure Key Vault libraries and Azure Identity libraries as part of the Azure Software Development Kit SDK that includes defense-in-depth feature improvements. We also published best practice guidance to help protect applications and services th...

Azure Identity SDK と Azure Key Vault SDKに関する多層防御のためのアップデートとベストプラクティスの実装ガイダンス

本ブログは、Defense-in-Depth Updates for Azure Identity SDK and Azure Key Vault SDK plus Best Practice Implementation Guidance の抄訳版です。最新の情報は...

Defense-in-Depth Updates for Azure Identity libraries and Azure Key Vault libraries within Azure SDK plus Best Practice Implementation Guidance

Summary Today, Microsoft released new versions of the Azure Key Vault libraries and Azure Identity libraries as part of the Azure Software Development Kit SDK that includes defense-in-depth feature improvements. We also published best practice guidance to help protect applications and services th...

Defense-in-Depth Updates for Azure Identity libraries and Azure Key Vault libraries within Azure SDK plus Best Practice Implementation Guidance

Summary Summary Today, Microsoft released new versions of the Azure Key Vault libraries and Azure Identity libraries as part of the Azure Software Development Kit SDK that includes defense-in-depth feature improvements. We also published best practice guidance to help protect applications and...

MAL-2022-1348 Malicious code in azure-keyvault-keys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 660172679fceb48d3856a6f9ac67e02a6917f304c430020232753ee280ed7d64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1350 Malicious code in azure-keyvault-keys-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3de0c04b9047a448fde22ce214893b20493e320d70c968f9f15732f471604e35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1347 Malicious code in azure-keyvault-certificates-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d4a4dd27ca78c3baf11188004219aee2dde382de300b316e2276af5c2613b81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1344 Malicious code in azure-keyvault-certificates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf46a9acf272f8e1a3fae7857b3808f0e8b28748ad3ddc58ef42ff1286ed07e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-certificates-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95f4c241905d9e557472c20ba2fce0d7a9246b1fd912f2b680a906e98699f866 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1351 Malicious code in azure-keyvault-secrets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be944ac1c65267da56d78a4f4ffb7b8561cc85353d589c7df16f6ebfbcb5e568 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1352 Malicious code in azure-keyvault-secrets-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 443a37add60cd6a3bd78fb9c4c91e1b5d9d836a32e0fcef0bc7e556dc6e15d4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1353 Malicious code in azure-keyvault-secrets-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e42b406b432ef2a203d09a5021bfb45c41a0d1af43c7f4436d87956264f7706 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-admin-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c6895fa55849501987a9fd8669e21d952f6d1e7aa884e5184c0d6858d12dd33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1341 Malicious code in azure-keyvault-admin-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75f9fc7c022ef300d02bd184ffb71a0a0502d64d13bb5df78992a2af90d740cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1346 Malicious code in azure-keyvault-certificates-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 882fdc11d87cda82ea735448d1e1a0fa7213cac0a11c7ae7c974ba3ecb523c34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AzureRT - A Powershell Module Implementing Various Azure Red Team Tactics

Powershell module implementing various cmdlets to interact with Azure and Azure AD from an offensive perspective. Helpful utilities dealing with access token based authentication, switching from Az to AzureAD and az cli interfaces, easy to use pre-made attacks such as Runbook-based command...

GHSA-GF8W-6HCM-RH3J Missing permission checks in Jenkins Azure Key Vault Plugin allow enumerating credentials IDs

Jenkins Azure Key Vault Plugin 2.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using...