Description
Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Debian Package Builder Plugin | unspecified – ≤ 1.6.11 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | ru.yandex.jenkins.plugins.debuilder:debian-package-builder | <= 1.6.11 | — | GHSA-64jr-ggw8-h9jc |