CVE-2023-24439: Plaintext Storage of a Password in Jenkins JIRA Pipeline Steps Plugin
Summary
CVE-2023-24439: Plaintext Storage of a Password in Jenkins JIRA Pipeline Steps Plugin. Affects org.jenkins-ci.plugins:jira-steps versions < 2.0.165.v8846cf59f3db. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins JIRA Pipeline Steps Plugin is a Maven-based package that provides functionality for integrating Jenkins pipelines with JIRA. It allows users to interact with JIRA issues and perform various actions within Jenkins pipelines. The plugin is widely used in software development and continuous integration workflows.
Vulnerability Detail
The Jenkins JIRA Pipeline Steps Plugin version 2.0.165.v8846cf59f3db and earlier suffers from a vulnerability where it stores private keys in plaintext in its global configuration file on the Jenkins controller. This file can be accessed by users with file system access to the Jenkins controller. As a result, sensitive information, such as passwords, can be viewed by unauthorized individuals. This vulnerability poses a moderate risk and can lead to unauthorized access to JIRA resources and potential data breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually encrypt the private keys stored in the global configuration file. This can be done by using encryption tools or libraries provided by the Jenkins platform. However, this workaround may introduce additional complexity and maintenance overhead.
Conclusion
The Jenkins JIRA Pipeline Steps Plugin suffers from a vulnerability that allows plaintext storage of passwords in its global configuration file. This can lead to unauthorized access to JIRA resources and potential data breaches. It is crucial to update the plugin to the latest version (2.0.166 or later) to fix the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:jira-steps →
FAQ
This vulnerability allows unauthorized individuals with access to the Jenkins controller file system to view sensitive information, such as passwords. It can lead to unauthorized access to JIRA resources and potential data breaches.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Yes, a fix has been released in version 2.0.166 or later of the Jenkins JIRA Pipeline Steps Plugin. It is recommended to update your plugin installation to the latest version to mitigate the vulnerability.
A temporary workaround is to manually encrypt the private keys stored in the global configuration file. However, this workaround may introduce additional complexity and maintenance overhead.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-g29v-5pwh-wxx4/GHSA-g29v-5pwh-wxx4.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:jira-steps.
