Description
OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is patched in version 4.0.1002.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OctopusDeploy OctopusDSC
< 4.0.1002affected
References
- https://github.com/OctopusDeploy/OctopusDSC/security/advisories/GHSA-phmm-rfg9-94fm ↗
- https://github.com/OctopusDeploy/OctopusDSC/releases/tag/v4.0.1002 ↗
- https://github.com/OctopusDeploy/OctopusDSC/pull/270 ↗
- https://github.com/OctopusDeploy/OctopusDSC/commit/24b448e6ac964ed938475add494a145c0473ac42 ↗