CVE-2019-10343: Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin
Summary
CVE-2019-10343: Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin. Affects io.jenkins:configuration-as-code versions < 1.25. Fixed in 1.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Configuration as Code Plugin is a tool that allows administrators to define Jenkins configuration settings using YAML files. It provides a way to manage Jenkins configuration as code, making it easier to version control and automate the setup of Jenkins instances. The plugin logs the changes it applies to the Jenkins system log. However, there was a vulnerability in versions 0.8-alpha to 1.0 of the plugin that resulted in sensitive information, such as passwords, being logged without proper masking, potentially leading to accidental disclosure.
Vulnerability Detail
The vulnerability (CVE-2019-10343) in the Jenkins Configuration as Code Plugin allowed sensitive information to be inserted into the log file. Prior to version 1.1, log messages contained values specified using properties in the YAML file, including secrets stored as type 'Secret' in Jenkins. However, this masking did not work in many instances, as plugins could use the 'Secret' type to store credentials encrypted on disk without exposing the Secret type in their Java API. The plugin now inspects the type and looks for a field, getter, or constructor argument corresponding to the property, making the secret detection more robust. The impact of this vulnerability could be the accidental exposure of sensitive information, including passwords, in the Jenkins system log.
How To Fix
Minimum fixed version
1.25
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, administrators can configure the logging level of the logger 'io.jenkins.plugins.casc.Attribute' to a level that does not include 'INFO' messages. This can be done by modifying the Jenkins logging configuration. By setting the logging level to a higher level, such as 'WARNING' or 'ERROR', the log messages containing sensitive information will not be logged. However, this workaround may impact the visibility of other log messages and should be used with caution.
Conclusion
The Jenkins Configuration as Code Plugin had a vulnerability that allowed sensitive information to be inserted into the log file without proper masking. This could lead to accidental disclosure of passwords and other sensitive data. To fix this vulnerability, it is important to upgrade to version 1.1 or later of the plugin. Administrators can also use a workaround by adjusting the logging level. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins:configuration-as-code →
FAQ
The Jenkins Configuration as Code Plugin is a tool that allows administrators to define Jenkins configuration settings using YAML files. It helps with version control and automation of Jenkins setup.
The vulnerability allowed sensitive information, such as passwords, to be logged without proper masking, potentially leading to accidental disclosure.
Versions 0.8-alpha to 1.0 of the Jenkins Configuration as Code Plugin were affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade the Jenkins Configuration as Code Plugin to version 1.1 or later.
Yes, administrators can configure the logging level of the logger 'io.jenkins.plugins.casc.Attribute' to a level that does not include 'INFO' messages.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins:configuration-as-code.
