Description
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Pipeline: Groovy Plugin | unspecified – ≤ 2648.va9433432b33c | 2.94.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | cri-o | 1.21.5-3.rhaos4.8.gitaf64931.el7 | RHSA-2022:0871 |
| Red Hat OpenShift 4 | haproxy +1 | 2.0.16-3.el7 | RHSA-2022:1620, RHSA-2022:1021 |
| Red Hat OpenShift 4 | haproxy22 | 2.2.15-4.el8 | RHSA-2022:1021 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.6.1650364520-1.el8 | RHSA-2022:1620, RHSA-2022:1248, RHSA-2022:1025 |
| Red Hat OpenShift 3 | jenkins | 2.319.3.1650348949-1.el7 | RHSA-2022:1420 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1650371376-1.el7 | RHSA-2022:1420 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins.workflow:workflow-cps | < 2656.vf7a_e7b_75a_457 | 2656.vf7a_e7b_75a_457 | GHSA-qv6q-x9vr-w7j3 |
Advisories 6
- RHSA-2022:1420 Red Hat Security Advisory: OpenShift Container Platform 3.11.685 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2022:1021 Red Hat Security Advisory: OpenShift Container Platform 4.9.26 security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2022:1620 Red Hat Security Advisory: OpenShift Container Platform 4.6.57 packages and security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2022:0871 Red Hat Security Advisory: OpenShift Container Platform 4.8.35 security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2022:1025 Red Hat Security Advisory: OpenShift Container Platform 4.10.6 security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2022:1248 Red Hat Security Advisory: OpenShift Container Platform 4.7.48 packages and security update Red Hat Security Advisories (RHSA) · Mar 21, 2026