Allele Security Alert
ASA-2019-00600
Identifier(s)
ASA-2019-00600, CVE-2019-10476, SECURITY-1621
Title
Stored credentials in plain text
Vendor(s)
Waseem Daher
Milan Koníř
Product(s)
Jenkins Zulip Plugin
Affected version(s)
Jenkins Zulip Plugin before version 1.1.1
Fixed version(s)
Jenkins Zulip Plugin version 1.1.1
Proof of concept
Unknown
Description
Zulip Plugin stored a credential unencrypted in its global configuration file jenkins.plugins.zulip.ZulipNotifier.xml, as well as in the legacy configuration file hudson.plugins.humbug.HumbugNotifier.xml on the Jenkins master. This credential could be viewed by users with access to the master file system.
Technical details
Unknown
Credits
Wasin Saengow
Reference(s)
Jenkins Security Advisory 2019-10-23
https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1621
oss-security – Multiple vulnerabilities in Jenkins plugins
https://www.openwall.com/lists/oss-security/2019/10/23/2
Jenkins security advisory
https://groups.google.com/d/msg/jenkinsci-advisories/KCv6eDsiV3Y/GNr0aDC3AQAJ
Jenkins Plugins
https://plugins.jenkins.io/zulip
SECURITY-1621 Store global config API key as Secret
https://github.com/jenkinsci/zulip-plugin/commit/2a9dd6c41c2d913b0414d015b3118e3ddb60bd90
CVE-2019-10476
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10476
CVE-2019-10476
https://nvd.nist.gov/vuln/detail/CVE-2019-10476
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: November 4, 2019