Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-56865

Password to access InfluxDB is stored unencrypted on disk

XMLWordPrintable

    • Icon: Improvement Improvement
    • Resolution: Fixed
    • Icon: Minor Minor
    • influxdb-plugin
    • None
    • Version 1.20.4, Jenkins 2.170
    • 1.22

      When configuring the plugin on "Configure System", the username and password are typed directly in a field - see attached screen shot.

      When saving, the user/password to access InfluxDB are saved in jenkinsci.plugins.influxdb.InfluxDbPublisher.xml unencrypted.

      This plugin should make use of Jenkins credentials, and have a dropbox here to select the correct username/password credentials.

      This is a security issue in my opinion and needs to be fixed ASAP.
      Thanks.

        1. Screen Shot 2019-04-03 at 11.22.52.png
          Screen Shot 2019-04-03 at 11.22.52.png
          17 kB

          [JENKINS-56865] Password to access InfluxDB is stored unencrypted on disk

          Aleksi Simell added a comment -

          You're absolutely true. It should use Jenkins credentials instead. I'll see what I can do.

          Aleksi Simell added a comment - You're absolutely true. It should use Jenkins credentials instead. I'll see what I can do.

          Aleksi Simell added a comment -

          Fix was done and released in version 1.22.

          In the future, please submit security related issues to SECURITY project as informed in https://jenkins.io/security/.

          Aleksi Simell added a comment - Fix was done and released in version 1.22. In the future, please submit security related issues to SECURITY project as informed in https://jenkins.io/security/ .

          An Nguyen added a comment -

          Do we have a ticket for making this plugin uses Jenkins credentials instead?

          An Nguyen added a comment - Do we have a ticket for making this plugin uses Jenkins credentials instead?

            aleksisimell Aleksi Simell
            michelzanini Michel Zanini
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: