~ / search / GHSA-rwh3-5g7v-3c5m

GHSA-rwh3-5g7v-3c5m

Password written to the build log by Jenkins SQLPlus Script Runner Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2312

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:sqlplus-script-runner < 2.0.13 2.0.13

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier prints the `sqlplus` command invocation to the build logs. This log message does not redact a password provided as part of a command line argument. This password can be viewed by users with Item/Read permission. Jenkins SQLPlus Script Runner Plugin 2.0.13 no longer prints the password in the build logs.

References

External links from the advisory. They lead to third-party sites.