PT-2023-26812 · Jenkins · Jenkins Chef Identity Plugin+1

Andrea Chiera · Published 2023-07-26 · Updated 2023-08-01 · CVE-2023-39155

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Chef Identity Plugin versions 2.0.3 and earlier

Description The issue concerns the Jenkins Chef Identity Plugin, where the user.pem key form field is not masked in versions 2.0.3 and earlier. This increases the potential for attackers to observe and capture the key. The plugin stores the user.pem key in its global configuration file io.chef.jenkins.ChefIdentityBuildWrapper.xml on the Jenkins controller. Although the key is stored encrypted on disk, the lack of masking in the global configuration form poses a risk.

Recommendations For Jenkins Chef Identity Plugin versions 2.0.3 and earlier, consider updating to a version where the user.pem key form field is properly masked to prevent potential attackers from observing and capturing it. As a temporary workaround, restrict access to the global configuration form to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Information Disclosure

Weakness Enumeration

CWE-668

CWE-200

Related Identifiers

CVE-2023-39155

GHSA-5JC5-M87X-88FJ

Affected Products

Jenkins

Jenkins Chef Identity Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2023-39155 · Vendor Advisory
• https://jenkins.io/security/advisory/2023-07-26/#SECURITY-3192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39155 · Security Note
• https://osv.dev/vulnerability/GHSA-5jc5-m87x-88fj · Vendor Advisory
• http://openwall.com/lists/oss-security/2023/07/26/2 · Note
• https://t.me/cvenotify/55234 · Telegram Post