This advisory announces a vulnerability in the SAML Plugin.
SAML Plugin stored keystore and private key passwords in plain text
The SAML Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access and Jenkins administrators to retrieve the stored password. The latter could result in exposure of the passwords through browser extensions, cross-site scripting vulnerabilities, and similar situations.
The SAML Plugin now stores passwords encrypted, and only transfers encrypted values as part of the configuration form after the initial configuration.