Description

Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

Remediation

References

https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-3075

http://www.openwall.com/lists/oss-security/2023/04/13/3

Related Vulnerabilities

CVE-2022-25647 Vulnerability in maven package com.google.code.gson:gson

CVE-2023-47327 Vulnerability in maven package org.silverpeas.core:silverpeas-core-web

CVE-2021-43309 Vulnerability in npm package uri-template-lite

CVE-2022-31129 Vulnerability in maven package org.webjars:momentjs

CVE-2023-38503 Vulnerability in npm package directus

Severity

High

Classification

CWE-319 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory Mailing List Third Party Advisory