CVE-2018-1000057
published 2018-02-09CVE-2018-1000057: Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided…
PriorityP420medium4.3CVSS 3.0
AVNACLPRLUINSUCLINAN
EPSS
0.68%
48.0th percentile
Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided password values, e.g. replacing environment variable references, which could result in values different from but similar to configured passwords being provided to the build. Those values are not subject to masking, and could allow unauthorized users to recover the original password.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | credentials_binding | <= 1.14 | — |
| jenkins | credentials_binding_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | junit_plugin | — | — |
| jenkins | supporting_apis_plugin | — | — |
CVSS provenance
nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials
osv·2022-05-13
CVE-2018-1000057 [MEDIUM] Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials
Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials
Jenkins Credentials Binding plugin allows specifying passwords and other secrets as environment variables, and will hide them from console output in builds.
However, since Jenkins will try to resolve references to other environment variables in environment variables passed to a build, this can result in values other than the one specified being provided to a build. For example, the value `p4$$w0rd` would result in Jenkins passing on `p4$w0rd`, as `$$` is the escape sequence for a single `$`.
Credentials Binding plugin does not prevent such a transformed value (e.g. `p4$w0rd`) from being shown on the build log, allowing users to reconstruct the actual password value from the transformed one.
Credentials Binding
GHSA
Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials
ghsa·2022-05-13
CVE-2018-1000057 [MEDIUM] CWE-522 Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials
Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials
Jenkins Credentials Binding plugin allows specifying passwords and other secrets as environment variables, and will hide them from console output in builds.
However, since Jenkins will try to resolve references to other environment variables in environment variables passed to a build, this can result in values other than the one specified being provided to a build. For example, the value `p4$$w0rd` would result in Jenkins passing on `p4$w0rd`, as `$$` is the escape sequence for a single `$`.
Credentials Binding plugin does not prevent such a transformed value (e.g. `p4$w0rd`) from being shown on the build log, allowing users to reconstruct the actual password value from the transformed one.
Credentials Binding
Jenkins
Jenkins Security Advisory 2018-02-05
vendor_jenkins·2018-02-05·CVSS 8.3
CVE-2018-1000054 [HIGH] Jenkins Security Advisory 2018-02-05
Title: Jenkins Security Advisory 2018-02-05
Jenkins Security Advisory 2018-02-05
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
android-lint
Plugin
ccm
Plugin
Credentials Binding
Plugin
JUnit
Plugin
Pipeline: Supporting APIs
Plugin
Description
XXE vulnerabilities in multiple static analysis plugins
SE
Red Hat
jenkins-plugin-credentials-binding: improper masking of the secret provided to the build in rare circumstances
vendor_redhat·2018-02-05·CVSS 4.3
CVE-2018-1000057 [MEDIUM] CWE-117 jenkins-plugin-credentials-binding: improper masking of the secret provided to the build in rare circumstances
jenkins-plugin-credentials-binding: improper masking of the secret provided to the build in rare circumstances
Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided password values, e.g. replacing environment variable references, which could result in values different from but similar to configured passwords being provided to the build. Those values are not subject to masking, and could allow unauthorized users to recover the original password.
Package: jenkins-plugin-credentials-binding (Red Hat OpenShift Enterprise 3) - Will not fix
No detection rules found.
No public exploits indexed.
2018-02-09
Published