CVE-2021-31821

Name of the Vulnerable Software and Affected Versions Windows Tentacle docker image (affected versions not specified)

Description The issue concerns the logging of commands and their arguments when the Windows Tentacle docker image starts up. This results in the Octopus Server API key being written in plaintext. The Linux Docker image is not affected by this issue.

Recommendations For the Windows Tentacle docker image, consider disabling the logging of commands and their arguments as a temporary workaround until a patch is available. Restrict access to the log files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.