CVE-2023-30514: Jenkins Azure Key Vault Plugin does not properly mask credentials

April 12, 2023

Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

References

github.com/advisories/GHSA-gmxm-pr58-v5jc
nvd.nist.gov/vuln/detail/CVE-2023-30514
www.jenkins.io/security/advisory/2023-04-12/

Code Behaviors & Features

Detect and mitigate CVE-2023-30514 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →