CVE-2019-10407: Project Inheritance Plugin displayed secret environment variables in Mask Passwords Plugin
Summary
CVE-2019-10407: Project Inheritance Plugin showed secret environment variables defined in Mask Passwords Plugin. Affects hudson.plugins:project-inheritance versions < 19.08.02. Fixed in 19.08.02. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Project Inheritance Plugin is a Maven package that is used in Jenkins, an open-source automation server. It allows users to define and inherit project configurations, including environment variables. The Mask Passwords Plugin is another Jenkins plugin that masks sensitive variables, such as passwords, in build logs and other output. However, a vulnerability in the Project Inheritance Plugin allowed secret environment variables contributed by the Mask Passwords Plugin to be displayed in plain text.
Vulnerability Detail
The vulnerability in the Project Inheritance Plugin (version 19.08.02 and earlier) allowed the disclosure of secret environment variables. When a build was executed, the Project Inheritance Plugin displayed a list of environment variables passed to the build. However, it failed to mask sensitive variables contributed by the Mask Passwords Plugin, leading to their exposure. This vulnerability could potentially expose sensitive information, such as passwords or API keys, to unauthorized users.
How To Fix
Minimum fixed version
19.08.02
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The Project Inheritance Plugin (version 19.08.02 and earlier) had a vulnerability that exposed secret environment variables contributed by the Mask Passwords Plugin. To fix this vulnerability, it is recommended to upgrade to version 19.08.02 or later. There is no known workaround for this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hudson.plugins:project-inheritance →
FAQ
This vulnerability could expose sensitive information, such as passwords or API keys, to unauthorized users.
Versions 19.08.01 and earlier are affected.
No, there is no known workaround. Upgrading to the fixed version is the recommended solution.
There are no known exploits for this vulnerability at this time.
More information about the fixed version can be found in the release notes of the Project Inheritance Plugin.
Related vulnerabilities
Recent vulnerabilities recorded for hudson.plugins:project-inheritance.
