GHSA-3p8r-p4q5-mc44

Violation Comments to GitLab Plugin has Insufficiently Protected Credentials

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10416

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:violation-comments-to-gitlab	< 2.29	2.29

Details

As written in the advisory (Markdown source, shown as plain text).

Violation Comments to GitLab Plugin stored API tokens unencrypted in job `config.xml` files and its global configuration file `org.jenkinsci.plugins.jvctgl.ViolationsToGitLabGlobalConfiguration.xml` on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or access to the Jenkins controller file system. Violation Comments to GitLab Plugin now stores these credentials encrypted. Existing jobs need to have their configuration saved for existing plain text credentials to be overwritten.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10416 advisory
https://github.com/jenkinsci/violation-comments-to-gitlab-plugin/commit/e8237a803012bae7773d8bd10fe02e21892be3fe web
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1577 web
http://www.openwall.com/lists/oss-security/2019/09/25/3 web