Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-26943

BasicSSHUserPrivateKey.DirectEntryPrivateKeySource.privateKey stored in plaintext

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Major Major
    • ssh-credentials-plugin
    • Credentials plugin version 1.18 on Jenkins 1.580.3 on ubuntu 14.04 LTS

      The credentials.xml file holds a plaintext copy of the credentials stored via Jenkins. On a fresh install of Jenkins, this file has world readable permissions by default:

      $ ls -l /var/lib/jenkins/credentials.xml
      rw-rr- 1 jenkins jenkins 2863 Feb 12 19:00 /var/lib/jenkins/credentials.xml

      It should have at least group readable permissions only.

            stephenconnolly Stephen Connolly
            wilrnh William Hutson
            Votes:
            2 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: