Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jenkinsci/credentials-binding-plugin

              master @ f9d34fd
            

Fixes

CVEs

MEDIUM

Peak severity

50.0%

Coverage

Highlights

Information Disclosure: 13 prior fixes. Scrutinize any change in this area.

src/main/java/org/jenkinsci/plugins/credentialsbinding/impl/SecretBuildWrapper.java: most-fixed (3 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Information Disclosure: Secrets can bypass console log masking due to expansion of special characters (like dollar signs) or because of premature removal of the secrets from the masking context before post-build steps run. Registering bound credentials as sensitive variables is critical to prevent leaks in build APIs.

Information Disclosure: Console log masking can be degraded or completely bypassed if short patterns (under 3 characters) or empty strings pollute the regex compiler, or if matching algorithms fail to process substrings in length-descending order. Furthermore, aggregate patterns must be restricted to the Jenkins controller JVM to prevent abuse.

Path Traversal: When writing temporary credential files to disk, failure to canonicalize paths or isolate the base name can allow attackers to perform directory traversal, especially on Windows systems using backslashes.