CVE-2022-29052: 
Java vulnerability analysis and mitigation

Jenkins Google Compute Engine Plugin version 4.3.8 and earlier contains a security vulnerability (CVE-2022-29052) discovered by Daniel Beck from CloudBees, Inc. The vulnerability was disclosed on April 12, 2022, affecting the plugin's handling of private keys in cloud agent configuration files (Jenkins Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The issue stems from the plugin storing private keys in an unencrypted format within cloud agent config.xml files on the Jenkins controller. This vulnerability is classified under CWE-522 (Insufficiently Protected Credentials) (NVD).

The vulnerability exposes private keys to unauthorized access, allowing them to be viewed by users with Agent/Extended Read permission or anyone with access to the Jenkins controller file system (Jenkins Advisory).

The vulnerability has been fixed in Google Compute Engine Plugin version 4.3.9, which implements encrypted storage for private keys. Users are advised to upgrade to this version to protect their credentials (Jenkins Advisory).