CVE-2019-10345: Plaintext Storage of a Password in Jenkins Configuration as Code Plugin
Summary
CVE-2019-10345: Plaintext Storage of a Password in Jenkins Configuration as Code Plugin. Affects io.jenkins:configuration-as-code versions < 1.25. Fixed in 1.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jenkins Configuration as Code Plugin is a Maven package (io.jenkins:configuration-as-code) that allows users to define Jenkins configuration settings using a YAML file. It provides a convenient way to manage and version control Jenkins configurations. However, prior to version 1.25, this plugin had a vulnerability that resulted in plaintext storage of a password in the configuration file. This means that the proxy password was not treated as a secret and could be easily accessed by unauthorized individuals.
Vulnerability Detail
The vulnerability in Jenkins Configuration as Code Plugin (CVE-2019-10345) allowed the proxy password to be stored in plaintext in the configuration file. This password was not masked when logging or encrypted for export, making it easily accessible to anyone with access to the file. This vulnerability could lead to unauthorized access to the proxy server and potential compromise of sensitive information. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2019-10345. The vulnerability has a CVSS v3 score of 5.5, indicating a moderate severity.
How To Fix
Minimum fixed version
1.25
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually mask the proxy password in the configuration file. This can be done by replacing the plaintext password with an encrypted or masked value. Here is an example of how to mask the password using the Jenkins Credentials Plugin:
- Install the Jenkins Credentials Plugin if not already installed.
- Create a new credential of type 'Username with password'.
- Use the generated credential ID in the configuration file instead of the plaintext password.
By following this workaround, the proxy password will be protected until the plugin can be upgraded to a secure version.
Conclusion
In conclusion, the Jenkins Configuration as Code Plugin prior to version 1.25 had a vulnerability that allowed the proxy password to be stored in plaintext. This could lead to unauthorized access to the proxy server and potential compromise of sensitive information. To fix this vulnerability, it is recommended to upgrade to version 1.25 or later. If immediate upgrade is not possible, a temporary workaround is available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins:configuration-as-code →
FAQ
Jenkins Configuration as Code Plugin is a Maven package that allows users to define Jenkins configuration settings using a YAML file. It provides a convenient way to manage and version control Jenkins configurations.
The vulnerability allows the proxy password to be stored in plaintext in the configuration file, making it easily accessible to unauthorized individuals. This could lead to unauthorized access to the proxy server and potential compromise of sensitive information.
To fix this vulnerability, it is recommended to upgrade to Jenkins Configuration as Code Plugin version 1.25 or later. This version includes the necessary changes to treat the proxy password as a secret and mask it when logging or encrypt it for export.
Yes, a temporary workaround is to manually mask the proxy password in the configuration file. This can be done by replacing the plaintext password with an encrypted or masked value using the Jenkins Credentials Plugin.
The CVSS v3 score of this vulnerability is 5.5, indicating a moderate severity.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins:configuration-as-code.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
