VulnerabilityDeferred

CVE-2024-12226

In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text.

MEDIUM 6.5EPSS 0.35%

Does this matter?

Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own.

Description

In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was identified in Version 2 however it was determined that this could also be achieved in Version 1 and the fix was applied to both versions accordingly.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.35% probability · 28th percentile
CISA KEV: Not listed
Weakness: CWE-532
Source: security@octopus.com

References

https://advisories.octopus.com/post/2024/sa2024-10/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.