Frequently Asked Questions for CVE-2023-25721 and CVE-2023-25722

Am I affected by CVE-2023-25721?

CVE-2023-25721 is a low-severity information disclosure issue. You are potentially affected if you:

- are using Veracode Scan Jenkins Plugin prior to 23.3.19.0

- AND have configured Veracode Scan to run on remote agent jobs

- AND have enabled the "Connect using proxy" option

- AND have configured the proxy settings with proxy credentials

- AND a Jenkins admin has enabled debug in global system settings.

By default, even in this configuration only the job owner or Jenkins admin can view the job log.

You should:

- upgrade to Veracode Scan Jenkins Plugin 23.3.19.0

- consider rotating any passwords used for proxy access that may have been disclosed in this manner.

I use Veracode Azure DevOps Extension, am I affected by CVE-2023-25721?

No, CVE-2023-25721 only applies to Veracode Scan for Jenkins.

I use Veracode Scan for Jenkins, am I affected by CVE-2023-25722?

CVE-2023-25722 is a low-severity information disclosure issue. You are affected if you:

- are using Veracode Scan Jenkins Plugin prior to 23.3.19.0

- AND have configured Veracode Scan to run on remote agent jobs.

You should:

- upgrade to Veracode Scan Jenkins Plugin 23.3.19.0.

Additionally, if you believe there are users with OS access to your Jenkins remotes that should not be authorized to view credentials configured in the Veracode Scan Jenkins Plugin you should:

- rotate any passwords used for proxy access by the Veracode Scan Jenkins Plugin

- rotate Veracode API credentials used by the Veracode Scan Jenkins Plugin

I use Veracode Azure DevOps Extension, am I affected by CVE-2023-25722?

CVE-2023-25722 is a low severity information disclosure issue.

You are affected if you:

- are using Veracode Azure DevOps Extension prior to 3.20.0

If you use the extension with:

- Azure DevOps Services

- OR with Azure DevOps Server and have enabled automatic updates

no action is required, your extension will be updated automatically.

If you use the extension with Azure DevOps Server and have not enabled automatic updates you should:

- upgrade to Veracode Azure DevOps Extension 3.20.0.

Additionally, if you believe there are users with OS-level access to your Azure DevOps Server or the Azure DevOps Services cloud infrastructure that should not be authorized to view credentials configured in the Veracode Azure DevOps Extension you should:

- rotate any passwords used for proxy access by the Veracode Azure DevOps Extension

- rotate Veracode API credentials used by the Veracode Azure DevOps Extension

I use the Veracode Java API Wrapper, am I affected by CVE-2023-25722?

No, but you may be affected by a similar issue if you use the Veracode Java API Wrapper prior to 23.3.11.0 directly and have configured your environment to run the Veracode Java API Wrapper using the -puser and -ppassword arguments on a host where other users not authorized to view these credentials may view the process list including arguments. You should:

- upgrade to Veracode Java API Wrapper 23.3.11.0 or newer

- reconfigure your environment to use the https_proxy/HTTPS_PROXY environment variable for passing proxy details to the Veracode Java API Wrapper

- rotate any passwords previously used for proxy access

Similarly, if you are using the command line arguments for providing Veracode API credentials (the -vid and -vkey options) it is recommended to consider:

- switching to VERACODE_API_KEY_ID/VERACODE_API_KEY_SECRET variables or a .veracode/credentials file

- rotating Veracode API credentials

What changed in the Veracode Java API Wrapper?

Veracode Java API Wrapper prior to 23.3.11.0 supports three ways to pass in Veracode API credentials (id and key):

- the ~/.veracode/credentials file

- environment variables VERACODE_API_KEY_ID and VERACODE_API_KEY_SECRET

- the -vid and -vkey command line arguments

Each option has unique security considerations and users may choose the appropriate option for their environment given their mitigating security controls.

By contrast, with Veracode Java API Wrapper prior to 23.3.11.0 proxy passwords could only be set using the -puser and -ppassword command line arguments alongside the -phost and -pport options to specify the host and port of the proxy server.

The 23.3.11.0 release introduced an additional way to provide the proxy information using the https_proxy/HTTPS_PROXY environment variable.