PT-2018-9314 · Jenkins · Jenkins Github Pull Request Builder Plugin+1

Steve Marlowe · Publicado 2018-04-05 · Atualizado 2022-05-14 · CVE-2018-1000142

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins GitHub Pull Request Builder Plugin versions 1.39.0 and older

Description An exposure of sensitive information issue exists in the Jenkins GitHub Pull Request Builder Plugin that allows an attacker with local file system access to obtain GitHub credentials. The issue is related to the GhprbCause.java file. Builds started before the plugin was updated will retain the encoded credentials on disk.

Recommendations For Jenkins GitHub Pull Request Builder Plugin versions 1.39.0 and older, update to version 1.40.0 or newer, as it no longer stores serialized objects containing the credential on disk. Additionally, revoke old GitHub credentials used in Jenkins. Use the provided script in the Script Console to attempt to remove old stored credentials from build.xml files.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-1000142

GHSA-HR74-2J5V-GHFV

Produtos afetados

Jenkins

Jenkins Github Pull Request Builder Plugin

Referências · 5

• https://github.com/jenkinsci/ghprb-plugin · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000142 · Nota de Segurança
• https://jenkins.io/security/advisory/2018-03-26/#SECURITY-261 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000142 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-hr74-2j5v-ghfv · Aviso do Fabricante