GitHub Advisoryadvisory · Maven

GHSA-jg29-c2qj-wpm3 Jenkins Anchore Container Scanner Plugin vulnerable to Insufficiently Protected Credentials

MEDIUM Published 2022-05-24 Modified 2022-12-06 Official page ↗
Aliases
CVE-2019-16542
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:anchore-container-scanner
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-522
Reviewed
2022-12-06

Affected packages

• Maven org.jenkins-ci.plugins:anchore-container-scanner: < 1.0.20 → fixed in 1.0.20

Description

Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. The credential being stored was a service password for the Anchore.io service. As the affected functionality has been deprecated, and the affected Anchore.io service has been shut down in late 2018, the affected feature has been removed.

Related

Alias · CVE (1)

  • CVE-2019-16542 Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References