GHSA-hfjr-m75m-wmh7

Jenkins Zulip Plugin vulnerable to Insufficiently Protected Credentials

Source: GitHub Advisory Database (reviewed) High CVE-2019-10476

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:zulip	< 1.1.1	1.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Zulip Plugin prior to 1.1.1 stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10476 advisory
https://github.com/jenkinsci/zulip-plugin/commit/2a9dd6c41c2d913b0414d015b3118e3ddb60bd90 web
https://github.com/jenkinsci/zulip-plugin package
https://github.com/jenkinsci/zulip-plugin/releases/tag/1.1.1 web
https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1621 web
http://www.openwall.com/lists/oss-security/2019/10/23/2 web