Low · 3.3 CVE-2019-10298 EUVD-2022-5709GHSA-x464-r7f4-gj3m

Jenkins Koji Plugin stores credentials in plain text

Published Apr 4, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Koji Plugin Package: koji Package: org.jenkins-ci.plugins:koji Category: Web / CMS Ecosystem: Azure Linux Ecosystem: Maven

Description

Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Koji Plugin	all versions as of 2019-04-03	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	koji	No fix yet	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:koji	<= 0.3	—	GHSA-x464-r7f4-gj3m

References

107790 vdb-entry
[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins mailing-list
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1092