~ / search / GHSA-v3r8-6vfj-pppf

GHSA-v3r8-6vfj-pppf

Plaintext Storage of a Password in Jenkins Build Notifications Plugin

Source: GitHub Advisory Database (reviewed) Low CVE-2022-34800

Packages

EcosystemPackageAffectedFixed in
Maven tools.devnull:build-notifications <= 1.5.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Build Notifications Plugin 1.5.0 and earlier stores multiple tokens unencrypted in its global configuration files on the Jenkins controller as part of its configuration:- Pushover Application Token in `tools.devnull.jenkins.plugins.buildnotifications.PushoverNotifier.xml`\n- Slack Bot Token in `tools.devnull.jenkins.plugins.buildnotifications.SlackNotifier.xml`\n- Telegram Bot Token in `tools.devnull.jenkins.plugins.buildnotifications.TelegramNotifier.xml`

References

External links from the advisory. They lead to third-party sites.