GHSA-7ff8-qfwx-8gx5

Source
https://github.com/advisories/GHSA-7ff8-qfwx-8gx5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7ff8-qfwx-8gx5/GHSA-7ff8-qfwx-8gx5.json
Aliases
Published
2022-05-24T17:17:14Z
Modified
2024-02-16T08:19:44.980365Z
Details

Credentials Binding Plugin allows specifying passwords and other secrets as environment variables, and will hide them from console output in builds. As a side effect of the fix for SECURITY-698, $ characters in secrets are escaped to $$. This will then be expanded to $ again once the secret is passed to (post) build steps.

Credentials Binding Plugin 1.22 and earlier does not mask the escaped form of the secret (containing $$). This occurs for example in the \"Execute Maven top-level targets\" build step included in Jenkins.\n\nCredentials Binding Plugin 1.23 now masks secrets both in their original form and with escaped $ characters, so they will be masked even if printed before value expansion.

References

Affected packages

Maven / org.jenkins-ci.plugins:credentials-binding

Package

Name
org.jenkins-ci.plugins:credentials-binding

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.23

Affected versions

1.*

1.0-beta-1
1.0
1.1
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9
1.10
1.11
1.12
1.13
1.14
1.15
1.16
1.17
1.18
1.19
1.20
1.20.1
1.21
1.22

Database specific 

{
    "last_known_affected_version_range": "<= 1.22"
}