CVE-2022-43419: Medium severity Jenkins Katalon Jenkins vulnerability
Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration.
These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Katalon Plugin 1.0.33 no longer stores the API keys directly, instead accessing them through its Credentials Plugin integration, once affected job configurations are saved again.
Other sources
Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.plugins:katalonto a version that resolves this vulnerability.Fixed in 1.0.33 - Upgrade
Upgrade
Jenkins Katalon Pluginto a version that resolves this vulnerability.Fixed in 1.0.33 - Operational
Ensure affected Jenkins job configurations are saved again so they no longer contain the API keys directly in job config.xml (Katalon Plugin 1.0.33 uses the Credentials Plugin integration instead).
- Operational
Rotate/revoke any exposed Katalon API keys that were stored unencrypted in Jenkins job config.xml for Jenkins Katalon Plugin 1.0.32 and earlier, since users with Item/Extended Read permission or access to the Jenkins controller filesystem could view them.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-43419?
The severity of CVE-2022-43419 is medium with a CVSS score of 6.5.
How does Jenkins Katalon Plugin 1.0.32 and earlier store API keys?
Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller.
Who can view the stored API keys in Jenkins Katalon Plugin 1.0.32 and earlier?
Users with Item/Extended Read permission or access to the Jenkins controller file system can view the stored API keys.
Is there a fix available for Jenkins Katalon Plugin vulnerability CVE-2022-43419?
Yes, the fix for Jenkins Katalon Plugin vulnerability CVE-2022-43419 is to upgrade to version 1.0.33.
What is the Common Weakness Enumeration (CWE) ID related to CVE-2022-43419?
The Common Weakness Enumeration (CWE) IDs related to CVE-2022-43419 are CWE-256 and CWE-522.