PT-2019-11744 · Jenkins · Jenkins Configuration As Code Plugin+1

Published 2019-07-31 · Updated 2023-10-25 · CVE-2019-10345

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Configuration as Code Plugin versions 1.20 and earlier Jenkins Configuration as Code Plugin versions prior to 1.25

Description The issue concerns the handling of the proxy password in the Jenkins Configuration as Code Plugin. Specifically, the plugin did not treat the proxy password as a secret, which means it was not properly masked when logging or encrypted for export.

Recommendations For versions 1.20 and earlier, update to version 1.25 or later to ensure the proxy password is handled as a secret. For versions prior to 1.25, update to version 1.25 or later to ensure the proxy password is properly masked and encrypted.

Fix

Insertion into Log File

Insufficiently Protected Credentials

Weakness Enumeration

CWE-256

CWE-532

CWE-522

Related Identifiers

CVE-2019-10345

GHSA-GGMX-PQ89-7MCR

Affected Products

Jenkins

Jenkins Configuration As Code Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2019-10345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10345 · Security Note
• https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1303 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ggmx-pq89-7mcr · Vendor Advisory
• https://github.com/jenkinsci/configuration-as-code-plugin/commit/73afe3cb10a723cb06e29c2e5499206aadae3a0d · Note
• https://github.com/jenkinsci/configuration-as-code-plugin · Note
• http://openwall.com/lists/oss-security/2019/07/31/1 · Note