Medium · 6.5 CVE-2019-10358 EUVD-2022-4204GHSA-hr96-qfvm-52r6

Maven Integration Plugin did not mask sensitive values in module build logs

Published Jul 31, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Maven Integration Plugin Package: org.jenkins-ci.main:maven-plugin Category: Web / CMS Ecosystem: Maven

Description

Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Maven Integration Plugin	3.3 and earlier	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.main:maven-plugin	< 3.4	3.4	GHSA-hr96-qfvm-52r6

References

[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins mailing-list
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-713