CVE-2023-32982: Jenkins Ansible Plugin stores and displays secrets in plain text
Summary
CVE-2023-32982: Jenkins Ansible Plugin stores and displays secrets in plain text. Affects org.jenkins-ci.plugins:ansible versions < 205.v4cb. Fixed in 205.v4cb. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Ansible Plugin is a tool that allows users to specify extra variables to be passed to Ansible, commonly used for passing secrets. The plugin version 204.v8191fd551eb_f and earlier stores these extra variables unencrypted in job config.xml files on the Jenkins controller. This means that anyone with Item/Extended Read permission or access to the Jenkins controller file system can view these secrets. Additionally, the job configuration form does not mask these extra variables, making it easier for attackers to observe and capture them. The plugin version 205.v4cb_c48657c21 addresses this issue by masking the extra variables on the configuration form and storing them encrypted once job configurations are saved again.
Vulnerability Detail
The vulnerability in the Jenkins Ansible Plugin allows secrets to be stored and displayed in plain text. This means that unauthorized users with access to the Jenkins controller or job config.xml files can view these secrets. The lack of encryption and masking increases the risk of attackers capturing sensitive information. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
205.v4cb
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of the Jenkins Ansible Plugin.
Conclusion
The Jenkins Ansible Plugin vulnerability allows secrets to be stored and displayed in plain text, increasing the risk of unauthorized access and misuse. Users are advised to upgrade to the latest version of the plugin to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ansible →
FAQ
This vulnerability allows unauthorized users to view and capture secrets stored in the Jenkins Ansible Plugin. This can lead to the exposure of sensitive information and potential misuse by attackers.
Users of Jenkins Ansible Plugin versions 204.v8191fd551eb_f and earlier are affected by this vulnerability.
There are no known exploits for this vulnerability at the moment. However, the lack of encryption and masking of secrets increases the risk of potential attacks.
Yes, the fix for this vulnerability is available in version 205.v4cb_c48657c21 or later of the Jenkins Ansible Plugin.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins Ansible Plugin version is affected by this vulnerability. Simply enter your pom.xml file and the playground will provide real-time alerts for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ansible.
