[SECURITY-835][CVE-2019-1003064] Fix for reported issue on Jenkins Jira. - Githubissues

awslabs / aws-device-farm-jenkins-plugin

Jenkins plugin for AWS Device Farm.

Apache License 2.0

89 stars 66 forks source link

[SECURITY-835][CVE-2019-1003064] Fix for reported issue on Jenkins Jira. #95

Closed piyushag-aws closed 5 years ago

piyushag-aws commented 5 years ago

Issue #, if available:

SECURITY-835 - Fix security issue related to credentials stores as plain text.
aws-device-farm plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.awsdevicefarm.AWSDeviceFarmRecorder.xml on the Jenkins master. These credentials can be viewed by users with access to the master file system.

Description of changes:

Used the Secret class provided by jenkins to use encryption in the persisted form, to avoid accidental exposure of a secret.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.