[JIRA] (JENKINS-56865) Password to access InfluxDB is stored unencrypted on disk

[michelzanini@gmail.com (JIRA)]

Michel Zanini created an issue

Jenkins / JENKINS-56865 Password to access InfluxDB is stored unencrypted on disk Issue Type: Task Assignee: Aleksi Simell Attachments: Screen Shot 2019-04-03 at 11.22.52.png Components: influxdb-plugin Created: 2019-04-03 14:25 Environment: Version 1.20.4, Jenkins 2.170 Priority: Minor Reporter: Michel Zanini When configuring the plugin on "Configure System", the username and password are typed directly in a field - see attached screen shot. When saving, the user/password to access InfluxDB are saved in jenkinsci.plugins.influxdb.InfluxDbPublisher.xml unencrypted. This plugin should make use of Jenkins credentials, and have a dropbox here to select the correct username/password credentials. This is a security issue in my opinion and needs to be fixed ASAP. Thanks. Add Comment

This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)

[aleksi.simell@eficode.com (JIRA)]

Aleksi Simell commented on JENKINS-56865

Re: Password to access InfluxDB is stored unencrypted on disk You're absolutely true. It should use Jenkins credentials instead. I'll see what I can do.

Add Comment

[aleksi.simell@eficode.com (JIRA)]

Aleksi Simell updated an issue

Jenkins / JENKINS-56865

Password to access InfluxDB is stored unencrypted on disk

Change By: Aleksi Simell Issue Type: Task Improvement

Add Comment

[aleksi.simell@eficode.com (JIRA)]

Aleksi Simell closed an issue as Fixed

Fix was done and released in version 1.22. In the future, please submit security related issues to SECURITY project as informed in https://jenkins.io/security/.

Jenkins / JENKINS-56865 Password to access InfluxDB is stored unencrypted on disk

Change By: Aleksi Simell Status: Open Closed Resolution: Fixed Released As: 1.22

Add Comment

[nthienan.it@gmail.com (JIRA)]

An Nguyen commented on JENKINS-56865

Re: Password to access InfluxDB is stored unencrypted on disk Do we have a ticket for making this plugin uses Jenkins credentials instead?

Add Comment