First published: Wed Jul 31 2019(Updated: )
Jenkins Maven Release Plug-in Plugin stored credentials unencrypted in its global configuration file `org.jvnet.hudson.plugins.m2release.M2ReleaseBuildWrapper.xml` on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. Maven Release Plug-in Plugin now stores credentials encrypted.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
Affected Software | Affected Version | How to fix |
---|---|---|
Jenkins M2release | <=0.14.0 | |
Jenkins Maven Release | ||
maven/org.jenkins-ci.plugins.m2release:m2release | <=0.14.0 | 0.15.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.