PT-2020-15333 · Jenkins · Jenkins Debian Package Builder Plugin+1

James Holderness · Published 2020-02-12 · Updated 2023-10-25 · CVE-2020-2125

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Debian Package Builder Plugin versions 1.6.11 and earlier

Description The issue concerns the storage of a GPG passphrase in an unencrypted manner within the global configuration file on the Jenkins master or controller. This file can be accessed by users with privileges to the master or controller file system, potentially exposing the credential. The specific configuration file affected is ru.yandex.jenkins.plugins.debuilder.DebianPackageBuilder.xml.

Recommendations For Jenkins Debian Package Builder Plugin versions 1.6.11 and earlier, consider restricting access to the Jenkins master or controller file system to minimize the risk of the GPG passphrase being viewed by unauthorized users. As a temporary workaround, limit the privileges of users who have access to the master or controller file system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-256

CWE-522

Related Identifiers

CVE-2020-2125

GHSA-64JR-GGW8-H9JC

Affected Products

Jenkins

Jenkins Debian Package Builder Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2125 · Security Note
• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1558 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2125 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-64jr-ggw8-h9jc · Vendor Advisory
• https://github.com/jenkinsci/debian-package-builder-plugin · Note
• http://openwall.com/lists/oss-security/2020/02/12/3 · Note
• https://t.me/cvenotify/924 · Telegram Post