REDHAT-BUG-1032391: Low severity jenkins subversion vulnerability
Kohsuke Kawaguchi reports:
Insecure storage of passwords in Subversion plugin.
Description Just noticed, that ssh-key passphrases in <JOB>/subversion.credentials are only coded in base64 an can easily be decoded. maybe this is fixed already. My setup is old and grown over time. Although i am running 1.500 the config-files may be old. i did run the "re-keying" process, as jenkins told me to do. Nevertheless, passphrases are still stored in base64
This was originally reported by Lennart Starr
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1032391?
The severity of REDHAT-BUG-1032391 is classified as a moderate security risk due to insecure password storage.
How do I fix REDHAT-BUG-1032391?
To fix REDHAT-BUG-1032391, update your Jenkins Subversion plugin to a version higher than 1.500 where the vulnerability is addressed.
What are the implications of REDHAT-BUG-1032391?
The implications of REDHAT-BUG-1032391 include potential unauthorized access to systems due to easily decodable ssh-key passphrases.
Who is affected by REDHAT-BUG-1032391?
REDHAT-BUG-1032391 affects users of the Jenkins Subversion plugin version 1.500 and older.
Can the issue in REDHAT-BUG-1032391 be exploited remotely?
Yes, the issue in REDHAT-BUG-1032391 can be exploited remotely if the attacker has access to the encoded passwords.