Octopus: >> Tentacle >> 3.15.2 Security Vulnerabilities
When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in plaintext. This does not affect the Linux Docker image
CVSS Score
5.5
EPSS Score
0.0
Published
2022-01-19
In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The fix was back-ported to 4.0.7.
CVSS Score
6.5
EPSS Score
0.002
Published
2019-08-23