Description
Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins Credentials Plugin | ≤ 1380.va_435002fa_924 | 1371.1373.v4eb_fa_b_7161e9 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:credentials | >= 1372, < 1381.v2c3a | 1381.v2c3a | GHSA-62jv-j4w7-5hh8 |
| Maven | org.jenkins-ci.plugins:credentials | < 1371.1373.v4eb | 1371.1373.v4eb | GHSA-62jv-j4w7-5hh8 |
Advisories 1
- WID-SEC-2024-3071 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 5, 2024
References
- Jenkins Security Advisory 2024-10-02 vendor-advisory