Skip to content
OpenAdvisories
Low · 3.1 CVE-2020-2182 EUVD-2022-2983GHSA-7ff8-qfwx-8gx5

Improper masking of some secrets in Jenkins Credentials Binding Plugin

Published May 6, 2020 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Credentials Binding Plugin Package: org.jenkins-ci.plugins:credentials-binding Category: Web / CMS Ecosystem: Maven

Description

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Credentials Binding Plugin unspecified – ≤ 1.22 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 4 jenkins-2-plugins 4.3.1601981312-1.el7 RHSA-2020:4265, RHSA-2020:3625, RHSA-2020:3453
Red Hat OpenShift 4 python-rsa +1 4.5-1.el7 RHSA-2020:3453
Red Hat OpenShift 3 atomic-enterprise-service-catalog +1 1:3.11.248-1.git.1.9aad2ef.el7 RHBA-2020:2990
Red Hat OpenShift 3 atomic-openshift-cluster-autoscaler 3.11.248-1.git.1.b5530f6.el7 RHBA-2020:2990
Red Hat OpenShift 3 atomic-openshift-descheduler 3.11.248-1.git.1.108ef32.el7 RHBA-2020:2990
Red Hat OpenShift 3 atomic-openshift-dockerregistry 3.11.248-1.git.1.bb4a1fc.el7 RHBA-2020:2990
Red Hat OpenShift 3 atomic-openshift-metrics-server 3.11.248-1.git.1.b53e0e3.el7 RHBA-2020:2990
Red Hat OpenShift 3 atomic-openshift-node-problem-detector 3.11.248-1.git.1.628ff22.el7 RHBA-2020:2990
Red Hat OpenShift 3 atomic-openshift-service-idler 3.11.248-1.git.1.4c42a90.el7 RHBA-2020:2990
Red Hat OpenShift 3 golang-github-openshift-oauth-proxy 3.11.248-1.git.1.9885abb.el7 RHBA-2020:2990
Red Hat OpenShift 3 jenkins-2-plugins 3.11.1593081747-1.el7 RHBA-2020:2990
Red Hat OpenShift 3 openshift-ansible +4 3.11.248-1.git.0.fd212c7.el7 RHBA-2020:2990
Red Hat OpenShift 3 openshift-enterprise-autoheal 3.11.248-1.git.1.0020348.el7 RHBA-2020:2990
Red Hat OpenShift 3 openshift-enterprise-cluster-capacity 3.11.248-1.git.1.37b107c.el7 RHBA-2020:2990
Red Hat OpenShift 3 openshift-kuryr +4 3.11.248-1.git.1.f90c804.el7 RHBA-2020:2990
Red Hat OpenShift 3 prometheus +1 3.11.248-1.git.1.ad54f5b.el7 RHBA-2020:2990
Red Hat OpenShift 3 prometheus-alertmanager +1 3.11.248-1.git.1.66abd18.el7 RHBA-2020:2990
Red Hat OpenShift 3 prometheus-node-exporter +1 3.11.248-1.git.1.32f87fc.el7 RHBA-2020:2990
Red Hat OpenShift 3 python-urllib3 +1 1.24.3-1.el7 RHBA-2020:2990

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:credentials-binding < 1.23 1.23 GHSA-7ff8-qfwx-8gx5

Advisories 4

References