PT-2020-15395 · Jenkins · Jenkins Credentials Binding Plugin+1

Published 2020-05-06 · Updated 2023-10-25 · CVE-2020-2182

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Credentials Binding Plugin versions 1.22 and earlier

Description The issue concerns the masking of secrets in the Jenkins Credentials Binding Plugin. Secrets containing a $ character are not properly masked in certain circumstances, potentially exposing sensitive information. The plugin allows specifying passwords and other secrets as environment variables and normally hides them from console output in builds. However, due to the escaping of $ characters to $$ and their subsequent expansion, secrets are not masked when printed before value expansion in some build steps, such as the "Execute Maven top-level targets" step.

Recommendations For Jenkins Credentials Binding Plugin versions 1.22 and earlier, update to version 1.23 or later to ensure that secrets are properly masked, including those with escaped $ characters.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2020-2182

GHSA-7FF8-QFWX-8GX5

RHSA-2020:3453

RHSA-2020:3625

RHSA-2020:4265

Affected Products

Jenkins

Jenkins Credentials Binding Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-7ff8-qfwx-8gx5 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2182 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2182 · Vendor Advisory
• https://github.com/jenkinsci/credentials-binding-plugin · Note
• https://github.com/jenkinsci/credentials-binding-plugin/commit/77681e0d184b0ccafa2a27da3b3bdbba95b4fe8f · Note
• http://openwall.com/lists/oss-security/2020/05/06/3 · Note