GHSA-h6x7-jq46-fp33

Improper credentials masking in Jenkins HashiCorp Vault Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-23109

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.datapipe.jenkins.plugins:hashicorp-vault-plugin	< 3.8.0	3.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-23109 advisory
https://github.com/jenkinsci/hashicorp-vault-plugin/commit/c7ad9779320bd8640d83790a985ebab240249b13 web
https://github.com/jenkinsci/hashicorp-vault-plugin package
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2213 web
http://www.openwall.com/lists/oss-security/2022/01/12/6 web