Configuration as Code

Security Warnings

• Missing permission check allowed anyone to export Jenkins configuration(last version affected: 0.7-alpha)
• Plain text logging of sensitive configuration variables(last version affected: 0.7-alpha)
• Secrets in system log messages not masked(last version affected: 1.24)
• Users without Overall/Administer permission allowed to access documentation(last version affected: 1.24)
• Proxy credentials not masked(last version affected: 1.20)
• Variable references evaluated when importing a previously exported configuration(last version affected: 1.24)
• Secret values exported in plain text(last version affected: 1.24)
• Secrets in system log messages not masked(last version affected: 1.26)
• Non-constant time token comparison(last version affected: 1.55)