Bug 1446495 (CVE-2017-1000242)

Summary: CVE-2017-1000242 jenkins-plugin-git-client: Storing sensitive information in world-readable temporary files (SECURITY-445)
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bleanhar, ccoleman, dedgar, dmcphers, jgoulding, joelsmith, tdawson
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: jenkins-plugin-git-client 2.4.4 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-21 11:53:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1471326    
Bug Blocks: 1395176, 1446496    

Description Adam Mariš 2017-04-28 08:32:07 UTC 
Temporary files were previously written to the Java temporary directory with default permissions. A malicious actor with local file access could have captured sensitive information by reading files from that directory. The temporary files typically are only on the file system for the duration of a single command line git invocation, but cloning a large Git repo could require an extended time with those sensitive files in the temporary directory.

This change sets permissions on the temporary files to be readable only by the file owner. If a workspace is available, a temporary directory adjacent to the workspace is used instead of the system temporary directory.

As a workaround, setting the system property java.io.tmpdir on Jenkins master and agents to a directory only accessible by the Jenkins process’s user would prevent this issue.

Affected versions: Git Client Plugin up to and including 2.4.2

External References:

https://jenkins.io/security/advisory/2017-04-27/