For example install the Credentials Binding plugin (1.0 just released), create a global username/password credentials, then make a job binding those credentials to $AUTH, and add an EnvInject build step adding some other variable, and a shell step running env. Both variables will be set correctly, but injectedEnvVars will show AUTH=user:pass in cleartext despite build.getSensitiveBuildVariables().contains("AUTH").

Even more insidious than I originally thought: the problem occurs even if the job makes no mention of EnvInject. The plugin merely needs to be enabled.

Do you have any indication of how long it would take to correct this? We have a number or projects that are held up waiting for this vulnerability to be corrected. Thank-You.

ndeloof solved it as part of d50c5a

Code changed in jenkins
User: Nicolas De Loof
Path:
src/main/java/org/jenkinsci/lib/envinject/EnvInjectAction.java
http://jenkins-ci.org/commit/envinject-lib/e181ac473a9ea3d8b531ff0f061e7ca7071f7d87
Log:
JENKINS-23447 only mask sensible data when injectedEnvVars.txt is persisted or exposed on UI

Code changed in jenkins
User: Nicolas De Loof
Path:
pom.xml
src/main/java/org/jenkinsci/plugins/envinject/EnvInjectAction.java
src/main/java/org/jenkinsci/plugins/envinject/EnvInjectPluginAction.java
http://jenkins-ci.org/commit/envinject-plugin/d3e2b61c7e858a6f34ec17a40a575e1a82d1274f
Log:
JENKINS-23447 only mask sensible data when displayed on UI or persisted on disk

if project does not have Sensitive variables, it raises NPE on

ERROR: Failed to record SCM polling for hudson.model.FreeStyleProject@105707ef[*************]
java.lang.NullPointerException
at org.jenkinsci.plugins.envinject.EnvInjectPluginAction$1.transformEntry(EnvInjectPluginAction.java:25)
at org.jenkinsci.plugins.envinject.EnvInjectPluginAction$1.transformEntry(EnvInjectPluginAction.java:23)

Code changed in jenkins
User: Gregory Boissinot
Path:
src/main/java/org/jenkinsci/plugins/envinject/EnvInjectPluginAction.java
http://jenkins-ci.org/commit/envinject-plugin/65f2715af6445d217e5df8a24bbd179f7841403f
Log:
Merge pull request #40 from dshvedchenko/master

JENKINS-23447 related , avoid NPE if there are no getSensibleVariables()

Compare: https://github.com/jenkinsci/envinject-plugin/compare/db0d1ef23baf...65f2715af644