Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1oNng3LWpxNDYtZnAzM80ijA

Improper credentials masking in Jenkins HashiCorp Vault Plugin

Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed.

Permalink: https://github.com/advisories/GHSA-h6x7-jq46-fp33
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oNng3LWpxNDYtZnAzM80ijA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: 4 months ago

CVSS Score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-h6x7-jq46-fp33, CVE-2022-23109
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-23109
• https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2213
• http://www.openwall.com/lists/oss-security/2022/01/12/6
• https://github.com/advisories/GHSA-h6x7-jq46-fp33

Affected Packages