CVE-2013-6372 (published 2014-05-08T14:29Z)

The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-255
cwe_name: Credentials Management Errors
description: Weaknesses in this category are related to the management of credentials.

Fix information:
repo_url: https://github.com/jenkinsci/subversion-plugin
commit_details: repo_url: https://github.com/jenkinsci/subversion-plugin
author: Kohsuke Kawaguchi
author_date: 2013-11-18 18:07:09-08:00
msg: [FIXED SECURITY-58]

encryption of passphrases wasn't sufficiently secure.
repository: repo_url: https://github.com/jenkinsci/subversion-plugin
repo_name: jenkinsci/subversion-plugin
description: Jenkins subversion plugin
repo_language: Java
owner: jenkinsci
file_changes: filename: SubversionSCM.java
change_type: ModificationType.MODIFY
diff: @@ -1508,19 +1508,23 @@ public class SubversionSCM extends SCM implements Serializable {
              */
             private static final long serialVersionUID = -1676145651108866745L;
             private final String userName;
-            private final String password; // scrambled by base64
+            private final Secret password; // for historical reasons, scrambled by base64 in addition to using 'Secret'
 
             public PasswordCredential(String userName, String password) {
                 this.userName = userName;
-                this.password = Scrambler.scramble(password);
+                this.password = Secret.fromString(Scrambler.scramble(password));
             }
 
             @Override
             public SVNAuthentication createSVNAuthentication(String kind) {
                 if(kind.equals(ISVNAuthenticationManager.SSH))
-                    return new SVNSSHAuthentication(userName,Scrambler.descramble(password),-1,false);
+                    return new SVNSSHAuthentication(userName, getPassword(),-1,false);
                 else
-                    return new SVNPasswordAuthentication(userName,Scrambler.descramble(password),false);
+                    return new SVNPasswordAuthentication(userName, getPassword(),false);
+            }
+
+            private String getPassword() {
+                return Scrambler.descramble(Secret.toString(password));
             }
         }
 
@@ -1533,7 +1537,7 @@ public class SubversionSCM extends SCM implements Serializable {
              */
             private static final long serialVersionUID = -4649332611621900514L;
             private final String userName;
-            private final String passphrase; // scrambled by base64
+            private final Secret passphrase; // for historical reasons, scrambled by base64 in addition to using 'Secret'
             private final String id;
 
             /**
@@ -1542,7 +1546,7 @@ public class SubversionSCM extends SCM implements Serializable {
              */
             public SshPublicKeyCredential(String userName, String passphrase, File keyFile) throws SVNException {
                 this.userName = userName;
-                this.passphrase = Scrambler.scramble(passphrase);
+                this.passphrase = Secret.fromString(Scrambler.scramble(passphrase));
 
                 Random r = new Random();
                 StringBuilder buf = new StringBuilder();
@@ -1613,7 +1617,7 @@ public class SubversionSCM extends SCM implements Serializable {
                         } else {
                             privateKey = FileUtils.readFileToString(getKeyFile(),"iso-8859-1");
                         }
-                        return new SVNSSHAuthentication(userName, privateKey.toCharArray(), Scrambler.descramble(passphrase),-1,false);
+                        return new SVNSSHAuthentication(userName, privateKey.toCharArray(), Scrambler.descramble(Secret.toString(passphrase)),-1,false);
                     } catch (IOException e) {
                         throw new SVNException(
                                 SVNErrorMessage.create(SVNErrorCode.AUTHN_CREDS_UNAVAILABLE,"Unable to load private key").initCause(e));
@@ -1635,10 +1639,10 @@ public class SubversionSCM extends SCM implements Serializable {
              */
             private static final long serialVersionUID = 5455755079546887446L;
             private final Secret certificate;
-            private final String password; // scrambled by base64
+            private final Secret password; // for historical reasons, scrambled by base64 in addition to using 'Secret'
 
             public SslClientCertificateCredential(File certificate, String password) throws IOException {
-                this.password = Scrambler.scramble(password);
+                this.password = Secret.fromString(Scrambler.scramble(password));
                 this.certificate = Secret.fromString(new String(Base64.encode(FileUtils.readFileToByteArray(certificate))));
             }
 
@@ -1648,7 +1652,7 @@ public class SubversionSCM extends SCM implements Serializable {
                     try {
                         SVNSSLAuthentication authentication = new SVNSSLAuthentication(
                                 Base64.decode(certificate.getPlainText().toCharArray()),
-                                Scrambler.descramble(password), false);
+                                Scrambler.descramble(Secret.toString(password)), false);
                         authentication.setCertificatePath("dummy"); // TODO: remove this JENKINS-19175 workaround
                         return authentication;
                     } catch (IOException e) {

programming_language: Java