CVE-2019-10367: Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin
Summary
CVE-2019-10367: Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin. Affects io.jenkins:configuration-as-code versions < 1.27. Fixed in 1.27. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Configuration as Code Plugin is a tool that allows administrators to define Jenkins configuration settings using a YAML file. It provides a convenient way to manage and version control Jenkins configurations. The plugin logs the changes it applies to the Jenkins system log. However, sensitive information such as passwords should be masked in the log to prevent accidental disclosure.
Vulnerability Detail
The Configuration as Code Plugin did not properly mask sensitive information in a log message written to the logger io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator. This log message could potentially expose passwords and other secrets to unauthorized users. The vulnerability was identified and reported as CVE-2019-10367. The impact of this vulnerability is moderate, with a CVSS score of 5.5.
How To Fix
Minimum fixed version
1.27
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can configure the logging level of the logger io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator to a level that does not include the log messages containing sensitive information. In Configuration as Code Plugin versions 1.25 and earlier, these messages are logged at the INFO level. Starting from version 1.26, they are logged at the FINE level. Administrators can refer to the logging documentation for detailed instructions on how to configure the logging level.
Conclusion
The Configuration as Code Plugin in Jenkins is vulnerable to the insertion of sensitive information into the log file. This can potentially expose passwords and other secrets to unauthorized users. To mitigate this risk, it is recommended to upgrade to Configuration as Code Plugin version 1.27 or later. Administrators can also configure the logging level as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins:configuration-as-code →
FAQ
The Configuration as Code Plugin is a Jenkins plugin that allows administrators to define Jenkins configuration settings using a YAML file. It provides a convenient way to manage and version control Jenkins configurations.
This vulnerability could potentially expose sensitive information such as passwords to unauthorized users. However, the impact is considered moderate with a CVSS score of 5.5.
To fix this vulnerability, it is recommended to upgrade to Configuration as Code Plugin version 1.27 or later. The fix ensures that sensitive information is properly masked in the log messages.
Yes, administrators can configure the logging level of the logger io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator to a level that does not include the log messages containing sensitive information. Refer to the logging documentation for instructions.
You can find more information about this vulnerability in the Jenkins security advisory for SECURITY-1279 and the GitHub advisory database entry for GHSA-7c3v-vc3x-x789.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins:configuration-as-code.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
