CVE-2020-2182: Medium severity jenkins credentials binding vulnerability
A vulnerability was found in Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a $ character in some circumstances.
Reference: http://www.openwall.com/lists/oss-security/2020/05/06/3
Other sources
Credentials Binding Plugin allows specifying passwords and other secrets as environment variables, and will hide them from console output in builds. As a side effect of the fix for SECURITY-698, $ characters in secrets are escaped to $$. This will then be expanded to $ again once the secret is passed to (post) build steps.
Credentials Binding Plugin 1.22 and earlier does not mask the escaped form of the secret (containing $$). This occurs for example in the \"Execute Maven top-level targets\" build step included in Jenkins.\n\nCredentials Binding Plugin 1.23 now masks secrets both in their original form and with escaped $ characters, so they will be masked even if printed before value expansion.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-2182?
The severity of CVE-2020-2182 is classified as medium.
How do I fix CVE-2020-2182?
To fix CVE-2020-2182, update the Jenkins Credentials Binding Plugin to version 1.23 or later.
What products are affected by CVE-2020-2182?
CVE-2020-2182 affects Jenkins Credentials Binding Plugin version 1.22 and earlier.
What does CVE-2020-2182 vulnerability affect specifically?
CVE-2020-2182 particularly affects secret masking for credentials that contain a '$' character.
Is there a workaround for CVE-2020-2182?
There is no documented workaround for CVE-2020-2182; updating the plugin is the recommended action.