CVE-2019-10343
published 2019-08-07CVE-2019-10343: Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be…
PriorityP410low3.3CVSS 3.1
AVLACLPRLUINSUCLINAN
EPSS
0.37%
29.5th percentile
Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be hidden when logging the configuration being applied.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | amazon_ec2_plugin | — | — |
| jenkins | between_configuration_as_code_plugin | — | — |
| jenkins | configuration_as_code | <= 1.26 | — |
| jenkins | configuration_as_code | <= 1.24 | — |
| jenkins | configuration_as_code_plugin | — | — |
| jenkins | deprecated_groovy_libraries_plugin | — | — |
| jenkins | google_kubernetes_engine_plugin | — | — |
| jenkins | maven_integration_plugin | — | — |
| jenkins | maven_release_plug-in_plugin | — | — |
| jenkins | sandbox_protection_in_script_security_plugin | — | — |
| jenkins | script_security_plugin | — | — |
| jenkins | since_configuration_as_code_plugin | — | — |
| jenkins | skytap_cloud_ci_plugin | — | — |
| jenkins_project | jenkins_configuration_as_code_plugin | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Jenkins
Jenkins Security Advisory 2019-07-31
vendor_jenkins·2019-07-31·CVSS 8.8
CVE-2019-10343 [HIGH] Jenkins Security Advisory 2019-07-31
Title: Jenkins Security Advisory 2019-07-31
Jenkins Security Advisory 2019-07-31
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Amazon EC2
Plugin
Configuration as Code
Plugin
Google Kubernetes Engine
Plugin
Maven Integration
Plugin
Maven Release Plug-in
Plugin
Pipeline: Deprecated Groovy Librari
OSV
Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin
osv·2022-05-24
CVE-2019-10343 [MEDIUM] Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin
Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin
Configuration as Code Plugin logs the changes it applies to the Jenkins system log. Secrets such as passwords should be masked (i.e. replaced with asterisks) in that log to prevent accidental disclosure.
Between Configuration as Code Plugin 0.8-alpha and 1.0, log messages contained values if the values were specified using properties in the YAML file (SECURITY-929).
Since Configuration as Code Plugin 1.1, log messages in Configuration as Code Plugin instead mask values of type `Secret`, which is used in Jenkins to store the values encrypted on disk. This did not work in many instances, as plugins could use the `Secret` type to store credentials encrypted on disk while not having the Secret type appe
GHSA
Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin
ghsa·2022-05-24
CVE-2019-10343 [MEDIUM] CWE-532 Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin
Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin
Configuration as Code Plugin logs the changes it applies to the Jenkins system log. Secrets such as passwords should be masked (i.e. replaced with asterisks) in that log to prevent accidental disclosure.
Between Configuration as Code Plugin 0.8-alpha and 1.0, log messages contained values if the values were specified using properties in the YAML file (SECURITY-929).
Since Configuration as Code Plugin 1.1, log messages in Configuration as Code Plugin instead mask values of type `Secret`, which is used in Jenkins to store the values encrypted on disk. This did not work in many instances, as plugins could use the `Secret` type to store credentials encrypted on disk while not having the Secret type appe
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-08-07
Published