GHSA-x23m-8c2h-6wg7

Redgate SQL Change Automation Plugin stored credentials in plain text

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2095

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.redgate.plugins.redgatesqlci:redgate-sql-ci	< 2.0.5	2.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

Redgate SQL Change Automation Plugin 2.0.4 and earlier stores a NuGet API key unencrypted in job config.xml files as part of its configuration. This credential could be viewed by users with Extended Read permission or access to the Jenkins controller file system. This is due to an incomplete fix of [SECURITY-1598](https://www.jenkins.io/security/advisory/2019-12-17/#SECURITY-1598). Redgate SQL Change Automation Plugin 2.0.5 now stores the API key encrypted. Existing jobs need to have their configuration saved for existing plain text passwords to be overwritten.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2095 advisory
https://github.com/jenkinsci/redgate-sql-ci-plugin/commit/962f1770eeb1f18dfac91d12461fa6db566e769e web
https://github.com/jenkinsci/redgate-sql-ci-plugin package
https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1696 web