Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb858fd6bf48 and earlier allows attackers with Overall/Read permission to obtain credentials stored in Vault with attacker-specified path and keys.
Recommended action: Upgrade to 355.v3b_38d767a_b_a_8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.
Recommended action: Upgrade to 336.v182c0fbaaeb7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system. This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system. This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.
Recommended action: Upgrade to 351.vdb_f83a_1c6a_9d or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed.
Recommended action: Upgrade to 3.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.