CVE-2017-1000362
CriticalSummary
The re-key admin monitor was introduced in Jenkins 1.498, re-encrypting all secrets in JENKINS_HOME with a new key and creating a backup directory with old secrets and the key used for encryption. These backups were world-readable and not removed afterwards.
Risk Assessment
Organizations may be at risk of sensitive information leakage if they do not remove the backup directory that may be accessible to unauthorized users.
Recommendation
Administrators are advised to check the directory $JENKINS_HOME/jenkins.security.RekeySecretAdminMonitor/backups and delete it if present.
Original NVD description (English source)
The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup directory with all old secrets, and the key used to encrypt them. These backups were world-readable and not removed afterwards. Jenkins now deletes the backup directory, if present. Upgrading from before 1.498 will no longer create a backup directory. Administrators relying on file access permissions in their manually created backups are advised to check them for the directory $JENKINS_HOME/jenkins.security.RekeySecretAdminMonitor/backups, and delete it if present.