CVE-2018-1999033: Exposure of Sensitive Information in Anchore Container Image Scanner Jenkins Plugin
Summary
CVE-2018-1999033: Exposure of sensitive information in Anchore Container Image Scanner Jenkins Plugin. Affects org.jenkins-ci.plugins:anchore-container-scanner versions < 1.0.17. Fixed in 1.0.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Anchore Container Image Scanner Jenkins Plugin is a Maven package that provides functionality for scanning container images in Jenkins. It allows users to analyze the security vulnerabilities and policy violations present in container images. This plugin is integrated with Jenkins to provide continuous security scanning of container images during the build process.
Vulnerability Detail
An exposure of sensitive information vulnerability (CVE-2018-1999033) exists in the Anchore Container Image Scanner Jenkins Plugin version 10.16 and earlier. The vulnerability is located in the AnchoreBuilder.java file. Attackers with Item/ExtendedRead permission or file system access to the Jenkins master can exploit this vulnerability to obtain the password stored in the plugin's configuration. This can lead to unauthorized access to sensitive information and potential compromise of the Jenkins environment.
How To Fix
Minimum fixed version
1.0.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of the Anchore Container Image Scanner Jenkins Plugin.
Conclusion
The exposure of sensitive information vulnerability in the Anchore Container Image Scanner Jenkins Plugin can lead to unauthorized access to sensitive information and compromise of the Jenkins environment. It is crucial to upgrade to version 1.0.17 or later of the plugin to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:anchore-container-scanner →
FAQ
The vulnerability allows attackers with specific permissions or file system access to obtain the password stored in the Anchore Container Image Scanner Jenkins Plugin's configuration. This can lead to unauthorized access to sensitive information and potential compromise of the Jenkins environment.
You can use Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to mitigate the risk of unauthorized access to sensitive information.
No, this vulnerability requires attackers to have Item/ExtendedRead permission or file system access to the Jenkins master. It cannot be exploited remotely.
No, upgrading to the latest version of the Anchore Container Image Scanner Jenkins Plugin is the recommended solution to fix this vulnerability. There are no known alternatives or workarounds.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:anchore-container-scanner.
