GHSA-79r5-rhrw-7pvh

Passwords stored in plain text by Jenkins Jabber (XMPP) notifier and control Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-21634

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jvnet.hudson.plugins:jabber	< 1.42	1.42

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Jabber (XMPP) notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file `hudson.plugins.jabber.im.transport.JabberPublisher.xml` on the Jenkins controller as part of its configuration. These passwords can be viewed by users with access to the Jenkins controller file system. Jenkins Jabber (XMPP) notifier and control Plugin 1.42 stores passwords encrypted once its configuration is saved again.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-21634 advisory
https://github.com/jenkinsci/jabber-plugin/commit/67882cfd189d6d05ad39e043edbfbf079dc37677 web
https://github.com/jenkinsci/jabber-plugin package
https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2162 web
http://www.openwall.com/lists/oss-security/2021/03/30/1 web