Incorrect control flow in Jenkins Gradle Plugin breaks credentials masking in the build log

보통 6.5CVE-2023-39152 · GHSA-pvjf-4hfg-wr84 · Published 26/07/2023 · updated 17/06/2026

요약

CVE-2023-39152은(는) org.jenkins-ci.plugins:gradle, gradle (jenkins)에 영향을 주는 보통 (CVSS 6.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.77%, 전체 취약점의 55.7%보다 높음.
조치: 2.8.1 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:gradle Maven	`< 2.8.1`	`2.8.1`
gradle jenkins	`= 2.8`	No fix yet

Description

Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.

NVD description

Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.

References

nvd.nist.gov/vuln/detail/CVE-2023-39152 · ADVISORY
jenkins.io/security/advisory/2023-07-26 · WEB
openwall.com/lists/oss-security/2023/07/26/2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free