CVE-2023-33001 – com.datapipe.jenkins.plugins:hashicorp-vault-plugin

Package

Manager: maven
Name: com.datapipe.jenkins.plugins:hashicorp-vault-plugin
Vulnerable Version: >=0 <=360.v0a

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00245 pctl0.47667

Details

Jenkins HashiCorp Vault Plugin has improper masking of credentials Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials printed in the build log from Pipeline steps like `sh` and `bat`, when both of the following conditions are met: - The credentials are printed in build steps executing on an agent (typically inside a `node` block). - Push mode for durable task logging is enabled. This is a hidden option in Pipeline: Nodes and Processes that can be enabled through the Java system property `org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING`. It is also automatically enabled by some plugins, e.g., OpenTelemetry and Pipeline Logging over CloudWatch. An improvement in Credentials Binding 523.525.vb_72269281873 implements a workaround that applies build log masking even in affected plugins. This workaround is temporary and potentially incomplete, so it is still recommended that affected plugins be updated to resolve this issue. As of publication of this advisory, there is no fix.

Metadata

Created: 2023-05-16T18:30:16Z
Modified: 2023-05-17T03:36:48Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-v3fv-v9m6-26g3/GHSA-v3fv-v9m6-26g3.json
CWE IDs: ["CWE-532"]
Alternative ID: GHSA-v3fv-v9m6-26g3
Finding: F009
Auto approve: 1