Incorrect control flow in Jenkins Gradle Plugin breaks credentials masking in the build log

2023-07-2615:30:57

Google

osv.dev

jenkins

gradle

plugin

credentials

build log

security

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

20.8%

JSON

Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.

CPENameOperatorVersion
org.jenkins-ci.plugins:gradleeq1.28
org.jenkins-ci.plugins:gradleeq1.39.3
org.jenkins-ci.plugins:gradleeq1.32
org.jenkins-ci.plugins:gradleeq1.36
org.jenkins-ci.plugins:gradleeq1.34
org.jenkins-ci.plugins:gradleeq2.3.1
org.jenkins-ci.plugins:gradleeq1.26
org.jenkins-ci.plugins:gradleeq1.16
org.jenkins-ci.plugins:gradleeq1.24
org.jenkins-ci.plugins:gradleeq1.23

Name	Operator	Version
org.jenkins-ci.plugins:gradle	eq	1.28
org.jenkins-ci.plugins:gradle	eq	1.39.3
org.jenkins-ci.plugins:gradle	eq	1.32
org.jenkins-ci.plugins:gradle	eq	1.36
org.jenkins-ci.plugins:gradle	eq	1.34
org.jenkins-ci.plugins:gradle	eq	2.3.1
org.jenkins-ci.plugins:gradle	eq	1.26
org.jenkins-ci.plugins:gradle	eq	1.16
org.jenkins-ci.plugins:gradle	eq	1.24
org.jenkins-ci.plugins:gradle	eq	1.23