CVE-2020-2125: Credentials stored in plain text by debian-package-builder Plugin
Summary
CVE-2020-2125: Credentials stored in plain text by debian-package-builder Plugin. Affects ru.yandex.jenkins.plugins.debuilder:debian-package-builder versions < 1.6.11. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The debian-package-builder Plugin is a Maven package for Jenkins that facilitates the creation of Debian packages. It is used to build and package software projects into Debian packages, which can then be installed on Debian-based systems. The plugin is designed to simplify the packaging process and provide a seamless integration with Jenkins. However, a vulnerability has been discovered in versions 1.6.11 and earlier of the plugin, where it stores a GPG passphrase in plain text in its global configuration file ru.yandex.jenkins.plugins.debuilder.DebianPackageBuilder.xml on the Jenkins controller. This means that the passphrase can be accessed by users with access to the Jenkins controller file system.
Vulnerability Detail
The vulnerability (CVE-2020-2125) in the debian-package-builder Plugin allows an attacker with access to the Jenkins controller file system to view the GPG passphrase stored in plain text. This passphrase is used for GPG signing during the packaging process. If an attacker gains access to this passphrase, they can potentially use it to sign malicious packages, compromising the integrity and authenticity of the software. This vulnerability poses a low risk as it requires local access to the Jenkins controller file system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround for this vulnerability. However, users can mitigate the risk by restricting access to the Jenkins controller file system and ensuring that only trusted users have access to the configuration files. It is also recommended to monitor the file system for any unauthorized access or modifications.
Conclusion
The debian-package-builder Plugin (versions 1.6.11 and earlier) is vulnerable to storing a GPG passphrase in plain text, which can be accessed by users with access to the Jenkins controller file system. To mitigate this vulnerability, it is recommended to upgrade to version 1.6.12 or later and ensure that the GPG passphrase is stored securely. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ru.yandex.jenkins.plugins.debuilder:debian-package-builder →
FAQ
The debian-package-builder Plugin is a Maven package for Jenkins that facilitates the creation of Debian packages.
The vulnerability allows an attacker with access to the Jenkins controller file system to view the GPG passphrase stored in plain text, potentially compromising the integrity and authenticity of the software.
To fix this vulnerability, it is recommended to upgrade to a version of the debian-package-builder Plugin that is not affected by this issue (version 1.6.12 or later). Additionally, it is advisable to rotate the GPG passphrase and ensure that it is not stored in plain text in any configuration files.
There is no specific workaround for this vulnerability. However, users can mitigate the risk by restricting access to the Jenkins controller file system and monitoring for any unauthorized access or modifications.
The severity of this vulnerability is low, as it requires local access to the Jenkins controller file system.
Related vulnerabilities
Recent vulnerabilities recorded for ru.yandex.jenkins.plugins.debuilder:debian-package-builder.
