CVE-2019-10370: Insertion of Sensitive Information into Log File in Jenkins Mask Passwords Plugin
Summary
CVE-2019-10370: Insertion of Sensitive Information into Log File in Jenkins Mask Passwords Plugin. Affects org.jenkins-ci.plugins:mask-passwords versions < 2.13.0. Fixed in 2.13.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Mask Passwords Plugin is a Maven package (org.jenkins-ci.plugins:mask-passwords) that provides functionality for masking passwords in Jenkins configuration files. It is commonly used to enhance security by preventing passwords from being exposed in plain text. However, versions 2.12.0 and earlier of the plugin have a vulnerability that transmits globally configured passwords in plain text as part of the configuration form. This can potentially result in the exposure of sensitive information.
Vulnerability Detail
The vulnerability (CVE-2019-10370) in the Jenkins Mask Passwords Plugin arises from the transmission of globally configured passwords in plain text. When configuring the plugin, passwords are sent as part of the configuration form without proper encryption or obfuscation. This can lead to the exposure of sensitive information if an attacker gains access to the log files or intercepts the transmission. The impact of this vulnerability can be significant, as it compromises the confidentiality of passwords and other sensitive data.
How To Fix
Minimum fixed version
2.13.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the fixed version of the Jenkins Mask Passwords Plugin.
Conclusion
The Jenkins Mask Passwords Plugin has a vulnerability (CVE-2019-10370) that allows globally configured passwords to be transmitted in plain text, potentially exposing sensitive information. To fix this vulnerability, it is crucial to upgrade to version 2.13.0 or later of the plugin. No specific workarounds are available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:mask-passwords →
FAQ
The vulnerability can result in the exposure of globally configured passwords in plain text, compromising the confidentiality of sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file to the playground, and it will alert you in real-time if the vulnerability is detected.
Yes, upgrading to version 2.13.0 or later of the Jenkins Mask Passwords Plugin fixes this vulnerability.
No specific workarounds are available for this vulnerability. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-gp67-c7j2-2qg2/GHSA-gp67-c7j2-2qg2.json).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:mask-passwords.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
