PT-2023-27397 · Jenkins · Jenkins Config File Provider Plugin+1

James Nord · Published 2023-08-16 · Updated 2023-08-22 · CVE-2023-40339

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Config File Provider Plugin versions 952.va 544a 6234b 46 and earlier

Description The issue concerns the Jenkins Config File Provider Plugin, where credentials specified in configuration files are not masked when written to the build log. This means that sensitive information, such as passwords, is visible in plain text, potentially exposing it to unauthorized access. The problem affects versions of the plugin up to 952.va 544a 6234b 46.

Recommendations For Jenkins Config File Provider Plugin versions 952.va 544a 6234b 46 and earlier, update to version 953.v0432a 802e4d2 or later, which masks credentials configured in configuration files if they appear in the build log.

Fix

Related Identifiers

CVE-2023-40339

GHSA-PV2G-VM98-VJXF

RHSA-2024:0777

RHSA-2024:0778

Affected Products

Jenkins

Jenkins Config File Provider Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-40339 · Security Note
• https://osv.dev/vulnerability/GHSA-pv2g-vm98-vjxf · Vendor Advisory
• https://jenkins.io/security/advisory/2023-08-16/#SECURITY-3090 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40339 · Vendor Advisory
• https://github.com/jenkinsci/config-file-provider-plugin/commit/0432a802e4d2e4eedfe88f7eb8593f85d1bd69d3 · Note
• https://t.me/cibsecurity/68660 · Telegram Post
• https://twitter.com/CVEnew/status/1691822016708436319 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1691853455567061338 · Twitter Post
• https://t.me/cvenotify/56789 · Telegram Post
• http://openwall.com/lists/oss-security/2023/08/16/3 · Note