CVE-2019-10416: Violation Comments to GitLab Plugin has Insufficiently Protected Credentials
Summary
CVE-2019-10416: Violation Comments to GitLab Plugin has Insufficiently Protected Credentials. Affects org.jenkins-ci.plugins:violation-comments-to-gitlab versions < 2.29. Fixed in 2.29. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Violation Comments to GitLab Plugin is a Maven package that integrates GitLab with Jenkins, allowing users to automatically post comments on GitLab merge requests based on violations found in the Jenkins build. It is widely used in software development workflows to improve code quality and collaboration. However, prior to version 2.29, the plugin stored API tokens unencrypted in job configuration files and the global configuration file on the Jenkins controller. This posed a security risk as these credentials could be accessed by unauthorized users or those with extended read permissions.
Vulnerability Detail
The vulnerability (CVE-2019-10416) in the Violation Comments to GitLab Plugin allowed API tokens to be stored in plain text, making them easily accessible to unauthorized users. This could lead to potential misuse of the tokens, compromising the security of the GitLab integration. Users with Extended Read permission or access to the Jenkins controller file system could view these credentials. The issue was addressed in version 2.29, which introduced encryption for storing the credentials. Existing jobs need to have their configuration saved to overwrite the plain text credentials.
How To Fix
Minimum fixed version
2.29
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The Violation Comments to GitLab Plugin had a vulnerability (CVE-2019-10416) that allowed API tokens to be stored in plain text, potentially compromising the security of the GitLab integration. This issue was addressed in version 2.29, which introduced encryption for storing the credentials. Users should upgrade to the fixed version and save the configuration of existing jobs to ensure the credentials are properly protected. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:violation-comments-to-gitlab →
FAQ
The Violation Comments to GitLab Plugin is a Maven package that integrates GitLab with Jenkins, allowing users to automatically post comments on GitLab merge requests based on violations found in the Jenkins build.
This vulnerability allows unauthorized users or those with extended read permissions to access API tokens stored in plain text. This could lead to misuse of the tokens and compromise the security of the GitLab integration.
To fix this vulnerability, upgrade to version 2.29 or later of the Violation Comments to GitLab Plugin and save the configuration of existing jobs to overwrite plain text credentials with encrypted ones.
No, there is no specific workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
It is recommended to regularly update the plugin to benefit from the latest security enhancements and bug fixes.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:violation-comments-to-gitlab.
