Unencrypted Password Storage in Jenkins Nomad Plugin by CloudBees

CVE-2021-21681

What is CVE-2021-21681?

The Jenkins Nomad Plugin versions 0.7.4 and earlier expose a significant vulnerability by storing Docker passwords in an unencrypted format within the global config.xml file on the Jenkins controller. This practice allows users with file system access to the controller to easily view sensitive information like Docker credentials, potentially compromising system integrity and security. It is crucial for users of this plugin to upgrade to a version that addresses this vulnerability to safeguard their environments.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References