| Package | Affected versions | Patched versions |
|---|---|---|
| com.bmuschko:gradle-vagrant-plugin | ≥ 0.6, < 3.0.0 | 3.0.0 |
| vagrant | ≥ 2.0, < 3.0.0< 0.6 | 3.0.00.6 |
The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables.
When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors.
Fixed in version 3.0.0
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free