SAML Plugin stored keystore and private key passwords in plain text
The SAML Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access and Jenkins administrators to retrieve the stored password. The latter could result in exposure of the passwords through browser extensions, cross-site scripting vulnerabilities, and similar situations.
The SAML Plugin now stores passwords encrypted, and only transfers encrypted values as part of the configuration form after the initial configuration.
Users of SAML Plugin should update it to version 1.0.3 or newer. Please be aware that version 1.0.3 of the plugin requires a Jenkins Core 2.60.1 or newer, which means this version can only be installed in:
- CloudBees Jenkins Enterprise 1.7.1 or newer.
- CloudBees Jenkins Platform 184.108.40.206 or newer (rolling train).
- CloudBees Jenkins Team 220.127.116.11 or newer.