GHSA-hr96-qfvm-52r6

Maven Integration Plugin did not mask sensitive values in module build logs

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10358

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.main:maven-plugin	< 3.4	3.4

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10358 advisory
https://github.com/jenkinsci/maven-plugin/commit/23e3fe5c43705883e4fb9d3ba052dfb1af3f2464 web
https://github.com/jenkinsci/maven-plugin package
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-713 web
http://www.openwall.com/lists/oss-security/2019/07/31/1 web