SB2020050720 - Multiple vulnerabilities in Jenkins Credentials Binding plugin

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Insufficiently protected credentials (CVE-ID: CVE-2020-2181)

The vulnerability allows a remote attacker to gain access to sensitive information on the system.

The vulnerability exists due to the affected plugin does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps. A remote authenticated attacker can gain unauthorized access to sensitive information on the target system.

2) Insufficiently protected credentials (CVE-ID: CVE-2020-2182)

The vulnerability allows a remote attacker to gain access to sensitive information on the system.

The vulnerability exists due to the affected plugin does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances. A remote authenticated attacker can gain unauthorized access to sensitive information on the target system.

Remediation

Install update from vendor's website.

References

• http://www.openwall.com/lists/oss-security/2020/05/06/3
• https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1374
• https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1835