Medium · 4.3 CVE-2022-38663 EUVD-2022-6582GHSA-jxmw-3gxf-fprh

Improper masking of credentials Jenkins in Git Plugin

Published Aug 23, 2022 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Git Plugin Package: git Package: org.jenkins-ci.plugins:git Category: Web / CMS Ecosystem: Azure Linux Ecosystem: Maven

Description

Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Git Plugin	unspecified – ≤ 4.11.4	4.9.4

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	git	No fix yet	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:git	< 4.11.5	4.11.5	GHSA-jxmw-3gxf-fprh