CVE-2019-10414: Jenkins Git Changelog Plugin Insufficiently Protected Credentials
Summary
CVE-2019-10414: Jenkins Git Changelog Plugin has Insufficiently Protected Credentials. Affects de.wellnerbou.jenkins:git-changelog versions < 2.18. Fixed in 2.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Git Changelog Plugin is a Maven package that provides functionality for generating changelogs from Git repositories. It is commonly used in Jenkins CI/CD pipelines to track changes and generate release notes. The plugin allows users to configure MediaWiki and Jira credentials for accessing these platforms. However, prior to version 2.18, the plugin stored these passwords unencrypted in the job configuration files (config.xml) on the Jenkins controller. This posed a security risk as these passwords could be accessed by users with Extended Read permission or by gaining access to the Jenkins controller file system.
Vulnerability Detail
The vulnerability (CVE-2019-10414) in the Jenkins Git Changelog Plugin allowed unauthorized users to view MediaWiki and Jira passwords stored in plain text within the job configuration files. This could lead to unauthorized access to MediaWiki and Jira accounts, potentially exposing sensitive information or allowing malicious activities. The vulnerability was addressed in version 2.18 of the plugin, which introduced encryption for storing these passwords. Existing jobs needed to be reconfigured and saved to overwrite the plain text passwords with the encrypted versions.
How To Fix
Minimum fixed version
2.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Jenkins Git Changelog Plugin prior to version 2.18 stored MediaWiki and Jira passwords unencrypted in job configuration files, posing a security risk. Upgrading to version 2.18 or later and reconfiguring existing jobs is necessary to address this vulnerability. It is recommended to follow security best practices and avoid storing sensitive credentials in plain text. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for de.wellnerbou.jenkins:git-changelog →
FAQ
The vulnerability allowed unauthorized users to view MediaWiki and Jira passwords stored in plain text, potentially leading to unauthorized access to these accounts and exposure of sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file as input.
There is no specific workaround for this vulnerability. Upgrading to the fixed version (2.18 or later) and reconfiguring existing jobs is the recommended solution.
No, manual encryption of the passwords in the job configuration files is not recommended. It is best to upgrade to the fixed version of the plugin, which handles the encryption automatically.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is important to promptly address the vulnerability to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for de.wellnerbou.jenkins:git-changelog.
