Lucene search

GoogleOSV:GHSA-HR96-QFVM-52R6

HistoryMay 24, 2022 - 4:51 p.m.

Maven Integration Plugin did not mask sensitive values in module build logs

2022-05-2416:51:50

Google

osv.dev

jenkins

maven

integration

plugin

sensitive

build

variables

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log.

References

www.openwall.com/lists/oss-security/2019/07/31/1

github.com/jenkinsci/maven-plugin

github.com/jenkinsci/maven-plugin/commit/23e3fe5c43705883e4fb9d3ba052dfb1af3f2464

jenkins.io/security/advisory/2019-07-31/#SECURITY-713

nvd.nist.gov/vuln/detail/CVE-2019-10358