Jenkins Security Advisory 2017-04-27

This advisory announces a vulnerability in the Git Client Plugin.

Description

Git Client Plugin stored sensitive information in world-readable temporary files

SECURITY-445 / CVE-2017-1000242

Temporary files were previously written to the Java temporary directory with default permissions. A malicious actor with local file access could have captured sensitive information by reading files from that directory. The temporary files typically are only on the file system for the duration of a single command line git invocation, but cloning a large Git repo could require an extended time with those sensitive files in the temporary directory.

This change sets permissions on the temporary files to be readable only by the file owner. If a workspace is available, a temporary directory adjacent to the workspace is used instead of the system temporary directory.

As a workaround, setting the system property java.io.tmpdir on the Jenkins controller and agents to a directory only accessible by the Jenkins process’s user would prevent this issue.

Severity

  • SECURITY-445: low.

Affected versions

  • Git Client Plugin up to and including 2.4.2.

Fix

  • Users of Git Client Plugin should update it to version 2.4.4 or newer.

Credit

The Jenkins project would like to thank the reporter for discovering and reporting this vulnerability:

  • Steven Christou, CloudBees, Inc. for SECURITY-445