GHSA-v67x-gpg7-mwv3

Exposure of Sensitive Information in Jenkins Kubernetes Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000187

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.csanchez.jenkins.plugins:kubernetes	< 1.7.1	1.7.1

Details

As written in the advisory (Markdown source, shown as plain text).

A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that results in sensitive variables such as passwords being written to logs.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000187 advisory
https://github.com/jenkinsci/kubernetes-plugin/commit/43a1d15b0875ae89ae16f2a2bfdd44ffd1e5f46d web
https://jenkins.io/security/advisory/2018-06-04/#SECURITY-883 web
https://www.jenkins.io/security/advisory/2018-06-04/#SECURITY-883 web