medium6.5
CVE-2022-23109
Improper credentials masking in Jenkins HashiCorp Vault Plugin
Impact
Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.datapipe.jenkins.plugins:hashicorp-vault-plugin | < 3.8.0 | 3.8.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Hashicorp Vault | through 3.7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2022/01/12/6
- https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2213
- https://github.com/advisories/GHSA-h6x7-jq46-fp33
- https://nvd.nist.gov/vuln/detail/CVE-2022-23109
- https://github.com/jenkinsci/hashicorp-vault-plugin/commit/c7ad9779320bd8640d83790a985ebab240249b13