GHSA-pv2g-vm98-vjxf

Source

https://github.com/advisories/GHSA-pv2g-vm98-vjxf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-pv2g-vm98-vjxf/GHSA-pv2g-vm98-vjxf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pv2g-vm98-vjxf

Aliases

CVE-2023-40339

Published

2023-08-16T15:30:18Z

Modified

2024-12-06T05:38:06.331860Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Jenkins Config File Provider Plugin improper credential masking vulnerability

Details

Jenkins Config File Provider Plugin 952.va544a6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they’re written to the build log.

Config File Provider Plugin 953.v0432a_802e4d2 masks credentials configured in configuration files if they appear in the build log.

Database specific

{
    "nvd_published_at": "2023-08-16T15:15:11Z",
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-16T21:13:44Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:config-file-provider

Package

Name: org.jenkins-ci.plugins:config-file-provider; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/config-file-provider

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

953.v0432a

Affected versions

1.*

1.0

1.1

1.2

1.5

1.6.1

1.9.1

2.*

2.0

2.1

2.1.1

2.2.1

2.3

2.4

2.5

2.5.1

2.6

2.6.1

2.6.2

2.7

2.7.1

2.7.4

2.7.5

2.8.1

2.9.2

2.9.3

2.10.0

2.10.1

2.11

2.13

2.14-beta

2.14.1-beta

2.14.2-beta

2.15

2.15.1

2.15.2-beta

2.15.3-beta

2.15.3

2.15.4

2.15.5

2.15.6

2.15.7

2.16.0

2.16.1

2.16.2

2.16.3

2.16.4

2.17

2.18

3.*

3.0

3.1

3.2

3.3

3.4

3.4.1

3.5

3.6

3.6.2

3.6.3

3.7.0

3.7.1

3.7.2

3.8.0

3.8.1

3.8.2

3.9.0

3.10.0

3.11

3.11.1

938.*

938.ve2b_8a_591c596

951.*

951.v0461b_87b_721b_

951.953.vdfc5f6e2dcc4

952.*

952.va_544a_6234b_46