Medium · 6.5 CVE-2023-39152 EUVD-2023-2118GHSA-pvjf-4hfg-wr84

Incorrect control flow in Jenkins Gradle Plugin breaks credentials masking in the build log

Published Jul 26, 2023 · Updated Oct 23, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Gradle Plugin Package: org.jenkins-ci.plugins:gradle Category: Web / CMS Ecosystem: Maven

Description

Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.

Affected products

Vendor	Product	Affected	Fixed
Jenkins Project	Jenkins Gradle Plugin	2.8	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:gradle	< 2.8.1	2.8.1	GHSA-pvjf-4hfg-wr84

Advisories 1

WID-SEC-2023-1902 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 26, 2023

References

Jenkins Security Advisory 2023-07-26 vendor-advisory
http://www.openwall.com/lists/oss-security/2023/07/26/2