CVE-2018-1000104: Jenkins Coverity Plugin Insufficiently Protected Credentials
Summary
CVE-2018-1000104: Jenkins Coverity Plugin has Insufficiently Protected Credentials. Affects org.jenkins-ci.plugins:coverity versions < 1.11.0. Fixed in 1.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Coverity Plugin is a tool used for integrating Jenkins with the Coverity static analysis platform. It allows developers to automate the analysis of their code for potential defects and vulnerabilities. The plugin provides a seamless integration between Jenkins and Coverity, enabling developers to easily manage and analyze their projects. However, versions 1.10.0 and earlier of the plugin suffer from a vulnerability that allows an attacker with local file system access or control of a Jenkins administrator's web browser to retrieve the configured keystore and private key passwords.
Vulnerability Detail
The vulnerability in the Jenkins Coverity Plugin arises from the plaintext storage of passwords in the CIMInstance.java file. This flaw enables an attacker with local file system access or control of a Jenkins administrator's web browser (e.g., through a malicious extension) to retrieve the keystore and private key passwords. The passwords are stored in plaintext, making them easily accessible to an attacker. The impact of this vulnerability is significant as it compromises the security of the Coverity Plugin and potentially exposes sensitive information.
How To Fix
Minimum fixed version
1.11.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the latest version of the Coverity Plugin.
Conclusion
The Jenkins Coverity Plugin suffers from a vulnerability that allows an attacker to retrieve sensitive passwords. Upgrading to version 1.11.0 or later of the plugin is recommended to fix this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:coverity →
FAQ
This vulnerability allows an attacker to retrieve the keystore and private key passwords, potentially compromising the security of the Coverity Plugin and exposing sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Yes, upgrading to version 1.11.0 or later of the Coverity Plugin fixes this vulnerability. The latest version integrates with the Credentials Plugin to securely store passwords.
No specific workarounds are provided for this vulnerability. The recommended solution is to upgrade to the latest version of the Coverity Plugin.
No, this vulnerability is classified as low severity with a CVSS score of 2.7.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:coverity.
