Description
Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
Remediation
References
http://www.openwall.com/lists/oss-security/2023/04/13/3
https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-3075
Related Vulnerabilities
CVE-2019-10648 Vulnerability in maven package net.sf.robocode:robocode
CVE-2022-25881 Vulnerability in maven package org.webjars.npm:http-cache-semantics
CVE-2022-0341 Vulnerability in npm package vditor
CVE-2018-8039 Vulnerability in maven package org.apache.cxf:cxf-rt-transports-http
CVE-2021-29441 Vulnerability in maven package com.alibaba.nacos:nacos-common