Description
Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins Kubernetes Plugin | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kubernetes +1 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.csanchez.jenkins.plugins:kubernetes | < 3910.ve59cec5e33ea | 3910.ve59cec5e33ea | GHSA-v5hq-cqqr-6w4g |
Advisories 1
- WID-SEC-2023-0952 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 12, 2023