medium6.5
CVE-2019-10358
Maven Integration Plugin did not mask sensitive values in module build logs
Impact
Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.main:maven-plugin | <= 3.3 | 3.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Maven | through 3.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2019/07/31/1
- https://jenkins.io/security/advisory/2019-07-31/#SECURITY-713
- https://github.com/advisories/GHSA-hr96-qfvm-52r6
- https://nvd.nist.gov/vuln/detail/CVE-2019-10358
- https://github.com/jenkinsci/maven-plugin/commit/23e3fe5c43705883e4fb9d3ba052dfb1af3f2464