CVE-2020-2125: 
Java vulnerability analysis and mitigation

CVE-2020-2125 affects the debian-package-builder Plugin version 1.6.11 and earlier. This vulnerability was disclosed on February 12, 2020, and impacts Jenkins automation server installations that use the affected plugin (Jenkins Advisory).

The vulnerability is related to insecure credential storage, where the debian-package-builder Plugin stores a GPG passphrase unencrypted in its global configuration file ru.yandex.jenkins.plugins.debuilder.DebianPackageBuilder.xml on the Jenkins controller. The severity of this vulnerability is rated as Low according to CVSS scoring (Jenkins Advisory).

The vulnerability allows users with access to the Jenkins controller file system to view the stored GPG passphrase credentials. This exposure of sensitive authentication information could potentially be used for unauthorized access to GPG-related functions (Jenkins Advisory).

As of the advisory publication date, there was no fix available for this vulnerability. Users should restrict access to the Jenkins controller file system and monitor for unauthorized access to the affected configuration file (Jenkins Advisory).