PT-2018-9244 · Jenkins · Jenkins Credentials Binding Plugin+1

Published 2018-02-09 · Updated 2022-05-13 · CVE-2018-1000057

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Credentials Binding Plugin version 1.14 and earlier

Description: The issue allows unauthorized users to recover original passwords due to Jenkins transforming provided password values, such as replacing environment variable references, which could result in unmasked values being provided to the build. For example, the value p4$$w0rd would be passed on as p4$w0rd because $$ is the escape sequence for a single $. This could enable users to reconstruct the actual password value from the transformed one. The issue affects freestyle and other classic job types but does not apply to Pipelines.

Recommendations: For Jenkins Credentials Binding Plugin version 1.14 and earlier, update the plugin to a version that escapes any $ characters in password values to prevent transformed values from being shown in the build log.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2018-1000057

GHSA-38XM-XHVJ-Q2QF

Affected Products

Jenkins

Jenkins Credentials Binding Plugin

References · 6

• https://jenkins.io/security/advisory/2018-02-05 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000057 · Security Note
• https://osv.dev/vulnerability/GHSA-38xm-xhvj-q2qf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000057 · Vendor Advisory
• https://github.com/jenkinsci/credentials-binding-plugin · Note
• https://github.com/jenkinsci/credentials-binding-plugin/commit/0c75238933365aa52b26b7c73fd1f742bfaca9b1 · Note