Description

A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that results in sensitive variables such as passwords being written to logs.

Remediation

References

https://jenkins.io/security/advisory/2018-06-04/#SECURITY-883

Related Vulnerabilities

CVE-2018-1000067 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2013-6373 Vulnerability in maven package org.jenkins-ci.plugins:exclusion

CVE-2021-36162 Vulnerability in maven package org.apache.dubbo:dubbo-cluster

CVE-2019-1351 Vulnerability in npm package nodegit

CVE-2015-8855 Vulnerability in npm package semver

Severity

High

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory