~ / search / GHSA-9v8g-f9mq-739g

GHSA-9v8g-f9mq-739g

Improper masking of credentials in Jenkins Pipeline Maven Integration Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-41934

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:pipeline-maven < 1331.v003efa_fd6e81 1331.v003efa_fd6e81

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked.

References

External links from the advisory. They lead to third-party sites.