PT-2021-14724 · Jenkins · Jenkins Nomad Plugin+1

Published 2021-08-31 · Updated 2023-11-22 · CVE-2021-21681

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Nomad Plugin versions 0.7.4 and earlier

Description The issue allows Docker passwords to be stored unencrypted in the global config.xml file on the Jenkins controller. These passwords can be viewed by users with access to the Jenkins controller file system. The passwords are part of the worker templates configuration and are used to authenticate against the Docker registry.

Recommendations For Jenkins Nomad Plugin versions 0.7.4 and earlier, update to version 0.7.5 or later to encrypt the Docker passwords. After updating, restart Jenkins for the change to take effect. As a temporary workaround, consider restricting access to the Jenkins controller file system to minimize the risk of password exposure.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-256

CWE-522

Related Identifiers

CVE-2021-21681

GHSA-5C2C-CVG6-GHJM

Affected Products

Jenkins

Jenkins Nomad Plugin

References · 8

• https://jenkins.io/security/advisory/2021-08-31/#SECURITY-2396 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21681 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5c2c-cvg6-ghjm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21681 · Security Note
• https://github.com/jenkinsci/nomad-plugin · Note
• https://github.com/jenkinsci/nomad-plugin/commit/d45123487d57c0e2a8a6869866b05362f690f511 · Note
• https://t.me/cibsecurity/28086 · Telegram Post
• http://openwall.com/lists/oss-security/2021/08/31/1 · Note