GHSA-jxmw-3gxf-fprh

Improper masking of credentials Jenkins in Git Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-38663

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:git	< 4.11.5	4.11.5

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-38663 advisory
https://github.com/jenkinsci/git-plugin/commit/3241db9cc696711c871d4e78b3c3c0daad0740c3 web
https://github.com/jenkinsci/git-plugin package
https://www.jenkins.io/security/advisory/2022-08-23/#SECURITY-2796 web
http://www.openwall.com/lists/oss-security/2022/08/23/2 web