CVE-2019-10367 Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin
MediumCVSS 5.5
EPSS 0.38%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be hidden when logging the configuration being applied.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| io.jenkins/configuration-as-code(Maven) | <= 1.26 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | < 1.27 | 1.27 |
| io.jenkins/configuration-as-code(Maven) | = 0.10-alpha | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 0.11-alpha | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 0.6-alpha | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 0.7-alpha | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 0.8-alpha | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 0.9-alpha | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.0 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.0-rc1 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.0-rc2 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.0-rc3 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.1 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.10 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.11 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.12 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.13 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.14 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.15 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.16 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.17 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.18 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.19 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.2 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.20 | No fix listed |
Show 15 more
| Product | Affected versions | Fixed in |
|---|---|---|
| io.jenkins/configuration-as-code(Maven) | = 1.21 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.22 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.23 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.24 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.25 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.26 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.3 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.4 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.5 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.6 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.7 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.8 | No fix listed |
| io.jenkins/configuration-as-code(Maven) | = 1.9 | No fix listed |
| jenkins configuration as code | <= 1.26 | No fix listed |
| Jenkins Project Jenkins Configuration as Code Plugin | = 1.26 and earlier | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- jenkins.io vendor-advisory
- [oss-security] 20190807 Multiple vulnerabilities in Jenkins plugins mailing-list third-party-advisory
- www.jenkins.io
- github.com patch
- github.com