Skip to content
OpenAdvisories
Medium · 5.3 CVE-2020-2181 EUVD-2022-2282GHSA-43j2-r4v3-m8jp

Secrets are not masked by Jenkins Credentials Binding Plugin in builds without build steps

Published May 6, 2020 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Credentials Binding Plugin Package: org.jenkins-ci.plugins:credentials-binding Category: Web / CMS Ecosystem: Maven

Description

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Credentials Binding Plugin unspecified – ≤ 1.22 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 4 jenkins-2-plugins 4.3.1601981312-1.el7 RHSA-2020:4265, RHSA-2020:3625, RHSA-2020:3453
Red Hat OpenShift 4 python-rsa +1 4.5-1.el7 RHSA-2020:3453
Red Hat OpenShift 3 atomic-enterprise-service-catalog +1 1:3.11.248-1.git.1.9aad2ef.el7 RHBA-2020:2990
Red Hat OpenShift 3 atomic-openshift-cluster-autoscaler 3.11.248-1.git.1.b5530f6.el7 RHBA-2020:2990
Red Hat OpenShift 3 atomic-openshift-descheduler 3.11.248-1.git.1.108ef32.el7 RHBA-2020:2990
Red Hat OpenShift 3 atomic-openshift-dockerregistry 3.11.248-1.git.1.bb4a1fc.el7 RHBA-2020:2990
Red Hat OpenShift 3 atomic-openshift-metrics-server 3.11.248-1.git.1.b53e0e3.el7 RHBA-2020:2990
Red Hat OpenShift 3 atomic-openshift-node-problem-detector 3.11.248-1.git.1.628ff22.el7 RHBA-2020:2990
Red Hat OpenShift 3 atomic-openshift-service-idler 3.11.248-1.git.1.4c42a90.el7 RHBA-2020:2990
Red Hat OpenShift 3 golang-github-openshift-oauth-proxy 3.11.248-1.git.1.9885abb.el7 RHBA-2020:2990
Red Hat OpenShift 3 jenkins-2-plugins 3.11.1593081747-1.el7 RHBA-2020:2990
Red Hat OpenShift 3 openshift-ansible +4 3.11.248-1.git.0.fd212c7.el7 RHBA-2020:2990
Red Hat OpenShift 3 openshift-enterprise-autoheal 3.11.248-1.git.1.0020348.el7 RHBA-2020:2990
Red Hat OpenShift 3 openshift-enterprise-cluster-capacity 3.11.248-1.git.1.37b107c.el7 RHBA-2020:2990
Red Hat OpenShift 3 openshift-kuryr +4 3.11.248-1.git.1.f90c804.el7 RHBA-2020:2990
Red Hat OpenShift 3 prometheus +1 3.11.248-1.git.1.ad54f5b.el7 RHBA-2020:2990
Red Hat OpenShift 3 prometheus-alertmanager +1 3.11.248-1.git.1.66abd18.el7 RHBA-2020:2990
Red Hat OpenShift 3 prometheus-node-exporter +1 3.11.248-1.git.1.32f87fc.el7 RHBA-2020:2990
Red Hat OpenShift 3 python-urllib3 +1 1.24.3-1.el7 RHBA-2020:2990

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:credentials-binding < 1.23 1.23 GHSA-43j2-r4v3-m8jp

Advisories 4

References