CVE-2019-15508: Medium severity octopus deploy vulnerability

Q: What is the severity of CVE-2019-15508?

CVE-2019-15508 is considered a medium severity vulnerability due to the exposure of sensitive information.

Q: How do I fix CVE-2019-15508?

To fix CVE-2019-15508, upgrade Octopus Tentacle or Octopus Server to version 5.0.1 or later.

Q: What are the affected versions of CVE-2019-15508?

CVE-2019-15508 affects Octopus Tentacle versions between 3.0.8 and 5.0.0 and Octopus Server versions between 3.0.8 and 2019.7.6.

Q: What type of information is exposed in CVE-2019-15508?

CVE-2019-15508 exposes the web request proxy password in cleartext in the deployment log.

Q: Who is impacted by CVE-2019-15508?

Users of Octopus Tentacle and Octopus Server versions specified are impacted if the web request proxy is configured.

Published Aug 23, 2019

Updated

In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The fix was back-ported to 4.0.7.

Affected Software

2 affected components

Octopus Server>=3.0.8<=2019.7.6

Octopus Tentacle>=3.0.8<=5.0.0

Event History

Aug 23, 2019

CVE Published

via MITRE·05:49 AM

Data Sourced

via MITRE·05:49 AM

Description

Frequently Asked Questions

What is the severity of CVE-2019-15508?

CVE-2019-15508 is considered a medium severity vulnerability due to the exposure of sensitive information.

How do I fix CVE-2019-15508?

To fix CVE-2019-15508, upgrade Octopus Tentacle or Octopus Server to version 5.0.1 or later.

What are the affected versions of CVE-2019-15508?