Medium · 6.5 CVE-2019-10407 EUVD-2022-5804GHSA-xj4w-r6gr-x5qm

Project Inheritance Plugin showed secret environment variables defined in Mask Passwords Plugin

Published Sep 25, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Project Inheritance Plugin Package: hudson.plugins:project-inheritance Category: Web / CMS Ecosystem: Maven

Description

Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Project Inheritance Plugin	2.0.0 and earlier	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	hudson.plugins:project-inheritance	< 19.08.02	19.08.02	GHSA-xj4w-r6gr-x5qm

References

https://jenkins.io/security/advisory/2019-09-25/#SECURITY-351
[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins mailing-list