How to Disable the visualization of Injected Environment variables in Jenkins

Question

Jenkins SECURITY-248 states that I should "Disable the visualization of Injected Environment variables in the global configuration." I cannot find this setting in the Configuration. Any help will be appreciated.

Answer 1

You can do the following to make sure to address this security issue correctly:

1. Check to see if you have any files affected by this security issue by executing this command: sudo find . -name "injectedEnvVars.txt"
2. Delete all the files recursively by executing the following command: sudo find . -name "injectedEnvVars.txt" -delete
3. Re-execute step #1 to make sure there are no files left.
4. Go to the Jenkins instance, from Configure Global Security under Environment Injector Plugin check Do not show injected variables.
5. From Configure Global Security under Hidden security warnings, click on Security Warnings and then uncheck Environment Injector Plugin: Exposure of sensitive build variables stored by EnvInject 1.90 and earlier. This will make sure to hide that error message so it doesn’t appear again.

Reference: https://jenkins.io/security/advisory/2018-02-26/#SECURITY-248

Answer 2

Configure Global Security {buildhost}/configureSecurity/

at the bottom is "Do not show injected variables"