SB2020021321 - Multiple vulnerabilities in Harvest SCM plugin for Jenkins

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Cleartext storage of sensitive information (CVE-ID: CVE-2020-2130)

The vulnerability allows a remote user to view the password on the target system.

The vulnerability exists due to the affected software stores SCM passwords unencrypted in its global configuration file "hudson.plugins.harvest.HarvestSCM.xml" on the Jenkins master. A remote user with access to the master file system can obtain credentials.

2) Cleartext storage of sensitive information (CVE-ID: CVE-2020-2131)

The vulnerability allows a remote user to view the password on the target system.

The vulnerability exists due to the affected software stores SCM passwords unencrypted in its job "config.xml" files on the Jenkins master. A remote user with Extended Read permission or access to the master file system can obtain credentials.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://www.openwall.com/lists/oss-security/2020/02/12/3
• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1553