Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
Credentials plugin version 1.18 on Jenkins 1.580.3 on ubuntu 14.04 LTS
Description
The credentials.xml file holds a plaintext copy of the credentials stored via Jenkins. On a fresh install of Jenkins, this file has world readable permissions by default:
$ ls -l /var/lib/jenkins/credentials.xml
rw-rr- 1 jenkins jenkins 2863 Feb 12 19:00 /var/lib/jenkins/credentials.xml
It should have at least group readable permissions only.
Code changed in jenkins
User: Stephen Connolly
Path:
src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKey.java
http://jenkins-ci.org/commit/ssh-credentials-plugin/c7cbe9a5c420026f8d118c7371cbaae16da6cade
Log:
Merge pull request #16 from felfert/fix
Fixes
JENKINS-26943Compare: https://github.com/jenkinsci/ssh-credentials-plugin/compare/3e1dd5c1fabe...c7cbe9a5c420