GHSA-5m8f-v3gw-h94w

Jenkins Support Core Plugin stores sensitive data in plain text

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-25187

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:support-core	< 2.79.1	2.79.1

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle. Support Core Plugin 2.79.1 adds a list of keywords whose associated values are redacted.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-25187 advisory
https://github.com/jenkinsci/support-core-plugin/commit/c6d20da4f372f03bd3e4844f0df2f109df68a63c web
https://github.com/jenkinsci/support-core-plugin/commit/e90487a87bc0a3445c887203f5badec17af905c5 web
https://github.com/jenkinsci/support-core-plugin package
https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2186 web