GHSA-5c2c-cvg6-ghjm

Suggest an improvement
Source
https://github.com/advisories/GHSA-5c2c-cvg6-ghjm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-5c2c-cvg6-ghjm/GHSA-5c2c-cvg6-ghjm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5c2c-cvg6-ghjm
Aliases
Published
2022-05-24T19:12:36Z
Modified
2024-02-16T08:10:21.552304Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Password stored in plain text by Jenkins Nomad Plugin
Details

Jenkins Nomad Plugin 0.7.4 and earlier stores the passwords to authenticate against the Docker registry unencrypted in the global config.xml file on the Jenkins controller as part of its worker templates configuration.

These passwords can be viewed by users with access to the Jenkins controller file system.

Jenkins Nomad Plugin 0.7.5 stores the Docker passwords encrypted. This change is effective after Jenkins restarts.

Database specific 
{
    "nvd_published_at": "2021-08-31T14:15:00Z",
    "cwe_ids": [
        "CWE-256",
        "CWE-522"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-16T15:47:12Z"
}
References

Affected packages

Maven / org.jenkins-ci.plugins:nomad

Package

Name
org.jenkins-ci.plugins:nomad
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/nomad

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.7.5

Affected versions

0.*

0.1
0.2
0.3
0.3.1
0.4
0.5.1
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.6.10
0.7.0
0.7.1
0.7.4

Database specific 

{
    "last_known_affected_version_range": "<= 0.7.4"
}