CVE-2020-2125 - Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system

Back Back to CVE browser

MEDIUM

Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system

Published Feb 12, 2020

4.3

MEDIUM

CVSS 3.1

EPSS 0.69%

Description

Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.

Affected products

Vendor Jenkins project Product Jenkins Debian Package Builder Plugin Default
unknown
Affected
- ≥ unspecified, ≤ 1.6.11

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins project	Jenkins Debian Package Builder Plugin	unknown	Affected ≥ unspecified, ≤ 1.6.11

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-256

CWE-522

Insufficiently Protected Credentials

References (5)

http://www.openwall.com/lists/oss-security/2020/02/12/3
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2710
Advisory
https://github.com/advisories/GHSA-64jr-ggw8-h9jc
Advisory
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1558
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2125

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2020/02/12/3		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2710		Advisory
https://github.com/advisories/GHSA-64jr-ggw8-h9jc		Advisory
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1558		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2125