Credentials stored in plain text by debian-package-builder Plugin

2022-05-2417:08:47

Google

osv.dev

0.001 Low

EPSS

Percentile

22.0%

JSON

debian-package-builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file ru.yandex.jenkins.plugins.debuilder.DebianPackageBuilder.xml on the Jenkins controller. This credential can be viewed by users with access to the Jenkins controller file system.

CPENameOperatorVersion
ru.yandex.jenkins.plugins.debuilder:debian-package-buildereq1.4
ru.yandex.jenkins.plugins.debuilder:debian-package-buildereq1.6.3
ru.yandex.jenkins.plugins.debuilder:debian-package-buildereq1.2
ru.yandex.jenkins.plugins.debuilder:debian-package-buildereq1.5.4
ru.yandex.jenkins.plugins.debuilder:debian-package-buildereq1.5.2
ru.yandex.jenkins.plugins.debuilder:debian-package-buildereq1.6.7
ru.yandex.jenkins.plugins.debuilder:debian-package-buildereq1.6.2
ru.yandex.jenkins.plugins.debuilder:debian-package-buildereq1.6.11
ru.yandex.jenkins.plugins.debuilder:debian-package-buildereq1.6.6
ru.yandex.jenkins.plugins.debuilder:debian-package-buildereq1.6.10

Name	Operator	Version
ru.yandex.jenkins.plugins.debuilder:debian-package-builder	eq	1.4
ru.yandex.jenkins.plugins.debuilder:debian-package-builder	eq	1.6.3
ru.yandex.jenkins.plugins.debuilder:debian-package-builder	eq	1.2
ru.yandex.jenkins.plugins.debuilder:debian-package-builder	eq	1.5.4
ru.yandex.jenkins.plugins.debuilder:debian-package-builder	eq	1.5.2
ru.yandex.jenkins.plugins.debuilder:debian-package-builder	eq	1.6.7
ru.yandex.jenkins.plugins.debuilder:debian-package-builder	eq	1.6.2
ru.yandex.jenkins.plugins.debuilder:debian-package-builder	eq	1.6.11
ru.yandex.jenkins.plugins.debuilder:debian-package-builder	eq	1.6.6
ru.yandex.jenkins.plugins.debuilder:debian-package-builder	eq	1.6.10