MEDIUM6.5

GHSA-pvjf-4hfg-wr84

Incorrect control flow in Jenkins Gradle Plugin breaks credentials masking in the build log

Quick fix

GHSA-pvjf-4hfg-wr84 — org.jenkins-ci.plugins:gradle: upgrade to the fixed version with the command below.

# pom.xml: bump <version>2.8.1</version> for org.jenkins-ci.plugins:gradle

Details

Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.jenkins-ci.plugins:gradle

Introduced in: 0Fixed in: 2.8.1

Fix# pom.xml: bump <version>2.8.1</version> for org.jenkins-ci.plugins:gradle

References

https://nvd.nist.gov/vuln/detail/CVE-2023-39152[ADVISORY]
https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3208[WEB]
http://www.openwall.com/lists/oss-security/2023/07/26/2[WEB]