PT-2018-9244 · Jenkins · Jenkins Credentials Binding Plugin+1

Publicado 2018-02-09 · Atualizado 2022-05-13 · CVE-2018-1000057

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Credentials Binding Plugin version 1.14 and earlier

Description: The issue allows unauthorized users to recover original passwords due to Jenkins transforming provided password values, such as replacing environment variable references, which could result in unmasked values being provided to the build. For example, the value p4$$w0rd would be passed on as p4$w0rd because $$ is the escape sequence for a single $. This could enable users to reconstruct the actual password value from the transformed one. The issue affects freestyle and other classic job types but does not apply to Pipelines.

Recommendations: For Jenkins Credentials Binding Plugin version 1.14 and earlier, update the plugin to a version that escapes any $ characters in password values to prevent transformed values from being shown in the build log.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2018-1000057

GHSA-38XM-XHVJ-Q2QF

Produtos afetados

Jenkins

Jenkins Credentials Binding Plugin

Referências · 6

• https://github.com/jenkinsci/credentials-binding-plugin · Nota
• https://github.com/jenkinsci/credentials-binding-plugin/commit/0c75238933365aa52b26b7c73fd1f742bfaca9b1 · Nota
• https://jenkins.io/security/advisory/2018-02-05 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000057 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-38xm-xhvj-q2qf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000057 · Aviso do Fabricante