Jenkins Security Advisory 2017-08-08

This advisory announces a vulnerability in the SAML Plugin.

Description

SAML Plugin stored keystore and private key passwords in plain text

JENKINS-46007

The SAML Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins controller local file system access and Jenkins administrators to retrieve the stored password. The latter could result in exposure of the passwords through browser extensions, cross-site scripting vulnerabilities, and similar situations.

The SAML Plugin now stores passwords encrypted, and only transfers encrypted values as part of the configuration form after the initial configuration.

Severity

  • JENKINS-46007: low

Affected versions

  • JENKINS-46007: SAML Plugin up to and including 1.0.2.

Fix

  • Users of SAML Plugin should update it to version 1.0.3 or newer.