PT-2023-24116 · Jenkins · Jenkins Ansible Plugin+1

Kevin Guerroudj · Published 2023-05-16 · Updated 2023-05-25 · CVE-2023-32983

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Ansible Plugin versions 204.v8191fd551eb f and earlier

Description The issue concerns the Jenkins Ansible Plugin, which allows the specification of extra variables that can be passed to Ansible, commonly used to pass secrets. These extra variables are stored unencrypted in job config.xml files on the Jenkins controller as part of its configuration and can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Furthermore, the job configuration form does not mask these extra variables, increasing the potential for attackers to observe and capture them.

Recommendations For Jenkins Ansible Plugin versions 204.v8191fd551eb f and earlier, update to version 205.v4cb c48657c21 or later to ensure extra variables are masked on the configuration form and stored encrypted once job configurations are saved again.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2023-32983

GHSA-97WP-63WQ-HFWH

Affected Products

Jenkins

Jenkins Ansible Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-32983 · Security Note
• https://jenkins.io/security/advisory/2023-05-16/#SECURITY-3017 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32983 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-97wp-63wq-hfwh · Vendor Advisory
• https://github.com/jenkinsci/ansible-plugin/commit/4cbc48657c21a65a917b3b3049918480198c0cfb · Note
• https://t.me/cibsecurity/64239 · Telegram Post