Details
-
Type:
Bug
-
Status: Closed (View Workflow)
-
Priority:
Minor
-
Resolution: Won't Fix
-
Component/s: git-client-plugin
-
Labels:None
-
Environment:Jenkins ver. 2.164.3 with OpenJDK "11.0.3+1-Debian-1bpo91"
git-client-plugin v2.7.7 and v3.0.0-beta9
Jenkins slave running OpenJDK11
-
Similar Issues:
Description
Hi,
I have an automated Jenkins setup. While provisioning, I add as part of init.groovy.d an SSH key as a new SSH key as credentials to the Jenkins master (new BasicSSHUserPrivateKey(..., new BasicSSHUserPrivateKey.FileOnMasterPrivateKeySource(sshKeyPath))). Furthermore, I add a job using this credentials, and I setup Jenkins slaves automatically.
When running my job the first time (which will run on a slave), I get the following exception
java.io.NotSerializableException: com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey$FileOnMasterPrivateKeySource at java.base/java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1185) at java.base/java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java:1553) at java.base/java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1510) at java.base/java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1433) at java.base/java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1179) at java.base/java.io.ObjectOutputStream.writeArray(ObjectOutputStream.java:1379) at java.base/java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1175) at java.base/java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java:1553) at java.base/java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1510) at java.base/java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1433) at java.base/java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1179) at java.base/java.io.ObjectOutputStream.writeObject(ObjectOutputStream.java:349) at hudson.remoting.UserRequest._serialize(UserRequest.java:264) at hudson.remoting.UserRequest.serialize(UserRequest.java:273) Caused: java.io.IOException: Unable to serialize UserRPCRequest:org.jenkinsci.plugins.gitclient.GitClient.addCredentials[java.lang.String,com.cloudbees.plugins.credentials.common.StandardCredentials](25) at hudson.remoting.UserRequest.serialize(UserRequest.java:275) at hudson.remoting.UserRequest.<init>(UserRequest.java:101) at hudson.remoting.Channel.call(Channel.java:955) at hudson.remoting.RemoteInvocationHandler.invoke(RemoteInvocationHandler.java:283) Caused: hudson.remoting.RemotingSystemException at hudson.remoting.RemoteInvocationHandler.invoke(RemoteInvocationHandler.java:299) at com.sun.proxy.$Proxy82.addCredentials(Unknown Source) at org.jenkinsci.plugins.gitclient.RemoteGitImpl.addCredentials(RemoteGitImpl.java:200) at hudson.plugins.git.GitSCM.createClient(GitSCM.java:845) at hudson.plugins.git.GitSCM.createClient(GitSCM.java:813) at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1186) at org.jenkinsci.plugins.workflow.steps.scm.SCMStep.checkout(SCMStep.java:120) at org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:90) at org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:77) at org.jenkinsci.plugins.workflow.steps.SynchronousNonBlockingStepExecution.lambda$start$0(SynchronousNonBlockingStepExecution.java:47) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) at java.base/java.lang.Thread.run(Thread.java:834
Reloading or restarting Jenkins solves the problem.
Attachments
Activity
Markus Schulte, this technique for loading private key files from the Jenkins master has been deprecated as part of SECURITY-440 - arbitrary file read vulnerability. The FileOnMaster javadoc says:
Deprecated.
This approach has security vulnerability and should be migrated to BasicSSHUserPrivateKey.DirectEntryPrivateKeySource
Does the same problem happen when using DirectEntryPrivateKeySource?
Resolving as won't fix since the specific technique for creating private key credentials has been deprecated and the submitter has not replied if the same condition exists for non-deprecated methods for creating the private key credentials.