Jenkins Security Advisory: Credential Masking & SSL Validation Bypass in Plugins (CVE-2023-30513-30518)

Jenkins Security Advisory 2023-04-12 Key Vulnerabilities Improper masking of credentials in multiple plugins CVE IDs: CVE-2023-30513, CVE-2023-30514, CVE-2023-30515 Severity: Medium Affected Plugins: Kubernetes, Azure Key Vault, Thycotic DevOps Secrets Vault Description: Credentials printed in build logs due to improper masking. Disabled SSL/TLS certificate validation for existing configurations in Image Tag Parameter Plugin CVE ID: CVE-2023-30516 Severity: Medium Affected Plugin: Image Tag Parameter Plugin Description: SSL/TLS certificate validation disabled by default. SSL/TLS certificate validation unconditionally disabled by NeuVector Vulnerability Scanner Plugin CVE ID: CVE-2023-30517 Severity: Medium Affected Plugin: NeuVector Vulnerability Scanner Plugin Description: SSL/TLS certificate and hostname validation unconditionally disabled. Missing permission check in Delinea Secret Server Plugin allows enumerating credentials IDs CVE ID: CVE-2023-30518 Severity: Medium Affected Plugin: Delinea Secret Server Plugin Description: Lack of permission check allows enumeration of credentials IDs. Affected Versions and Fixes Various Jenkins plugins with specific version ranges are affected. Fixes are available for some plugins, but not all at the time of publication. Credits Several researchers and organizations are credited for discovering and reporting these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: Credential Masking & SSL Validation Bypass in Plugins (CVE-2023-30513-30518)