SB2019092716 - Information disclosure in Azure Event Grid Build Notifier plugin for Jenkins

Description

This security bulletin contains information about 1 vulnerability.

1) Cleartext storage of sensitive information (CVE-ID: CVE-2019-10421)

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to view the password on the target system.

The vulnerability exists due to the affected software stores the Azure Event Grid secret key unencrypted in job "config.xml" files on the Jenkins master. A local authenticated user with Extended Read permission or access to the master file system can obtain credentials.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://www.openwall.com/lists/oss-security/2019/09/25/3
• https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1544