{"id":"CVE-2022-39309","summary":"GoCD server secret encryption/decryption key leaked to agents during material serialization","details":"GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 leak the symmetric key used to encrypt/decrypt any secure variables/secrets in GoCD configuration to authenticated agents. A malicious/compromised agent may then expose that key from memory, and potentially allow an attacker the ability to decrypt secrets intended for other agents/environments if they also are able to obtain access to encrypted configuration values from the GoCD server. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds.","aliases":["GHSA-f9qg-xcxq-cgv9"],"modified":"2026-08-12T13:33:13.255209Z","published":"2022-10-14T00:00:00Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-200","CWE-499"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39309.json"},"references":[{"type":"WEB","url":"https://github.com/gocd/gocd/releases/tag/21.1.0"},{"type":"WEB","url":"https://www.gocd.org/releases/#21-1-0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39309.json"},{"type":"ADVISORY","url":"https://github.com/gocd/gocd/security/advisories/GHSA-f9qg-xcxq-cgv9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39309"},{"type":"FIX","url":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gocd/gocd","events":[{"introduced":"0"},{"fixed":"5a4959c7c4ede49165ec961b0219126cd5aa9e52"},{"fixed":"691b479f1310034992da141760e9c5d1f5b60e8a"}],"database_specific":{"cpe":"cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"21.1.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["20.10.0","20.9.0","20.8.0","20.7.0","20.6.0","20.5.0","20.4.0","20.3.0","20.2.0","20.1.0","19.12.0","19.11.0","19.10.0","19.9.0","19.8.0","19.7.0","19.6.0","19.5.0","19.4.0","19.3.0","19.2.0","19.1.0","18.12.0","18.11.0","18.10.0","18.9.0","18.8.0","18.7.0","18.6.0","18.5.0","18.4.0","18.3.0","18.2.0","18.1.0","17.12.0","17.11.0","17.10.0","17.9.0","17.8.0","17.7.0","17.6.0","17.5.0","17.4.0","17.3.0","17.2.0","17.1.0","16.12.0","16.11.0","16.10.0","16.9.0","16.8.0","16.7.0","16.6.0","16.5.0","16.4.0","16.3.0","16.2.0","16.1.0","15.3.0","15.2.0","15.1.0","14.4.0","14.3.0","14.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39309.json","vanir_signatures_modified":"2026-08-12T13:33:13Z","vanir_signatures":[{"digest":{"line_hashes":["126628780793487669201164897487019733626","192035289694491337404602642346012400669","163614679553047861374667026619276423705","30376695070200042221068239015138893903","143551910623313034461908570535431750478","17667850178051805373570820340472471119","112475096043763931349990449160311464649","157086847158145875743087433883016345138"],"threshold":0.9},"id":"CVE-2022-39309-00136a58","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/git/GitMaterial.java"},"deprecated":false},{"id":"CVE-2022-39309-09a5f8a5","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldGetLongDescriptionForMaterial"},"deprecated":false,"digest":{"function_hash":"50319768712802991003003396944032391295","length":281}},{"deprecated":false,"digest":{"line_hashes":["269692291455158124535542657155857063055","183405107849252887120319748725631660782","91701607366284484907784325599645271799","279241920757025203325476699902529112868","220322623641877964322605078277620003601","182672728115141620873763004401766535944","223436388282003792620241699947009956565","205199107300961384430379328637305712517","38496160952165281444501782363062091595","60347428226116081326347022231278899973","27188413564496827452431935455526132290","76009758444262631463525227133555177050","194312445610176145000369628524433373009","110174411278944811300257771595377956441","160735474419989607134664410755671248890","268095940000795262711130522755284963909","195504503019357347158864718320057295261","192672739158826640128693843813587686897","160433420298617118734347665604758431473","197034889879487848292896718808155008882","162183311762699029852955085931211702965","58911969382656239178548430439297672507"],"threshold":0.9},"id":"CVE-2022-39309-0fc6c4dd","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/perforce/P4MaterialTest.java"}},{"target":{"function":"getTfsMaterial","file":"domain/src/main/java/com/thoughtworks/go/config/materials/Materials.java"},"deprecated":false,"digest":{"function_hash":"39796741941872310502445824906495796105","length":117},"id":"CVE-2022-39309-1005cdd2","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a"},{"target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldErrorOutIfDecryptionFails"},"deprecated":false,"digest":{"function_hash":"276700208942071128921831647468829338747","length":555},"id":"CVE-2022-39309-11f4c636","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a"},{"id":"CVE-2022-39309-14b6bb97","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/test/java/com/thoughtworks/go/helper/MaterialsMother.java","function":"tfsMaterial"},"deprecated":false,"digest":{"function_hash":"35013225215817117286960992897180964657","length":153}},{"signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/mercurial/HgMaterial.java","function":"HgMaterial"},"deprecated":false,"digest":{"function_hash":"285738133661736457736552440106417709999","length":52},"id":"CVE-2022-39309-1510762a","signature_type":"Function"},{"digest":{"function_hash":"57701587489353261692638060964605229413","length":63},"id":"CVE-2022-39309-15a40941","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/domain/materials/DummyMaterial.java","function":"DummyMaterial"},"deprecated":false},{"source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/ScmMaterial.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["42353034817920897068012029548689974699","234198574225296303509567425265267031334","236817553476831546626005127250125138296","189892048652864919830864206987888207213","255702976544144074001489300849071223956","98072151041453829209462953372559534591","32664387536686188002241252021302506730","294823799012731682939930706491504154490","142816736081210963331435970716868879088","242169978667255141518173474302178180718","204152151382595244049001827947006109526","41401659722307006420522075082361156889","63187711253244586797478032270853097018","10272073546990562182643681298887441280","271654366402786907945073777466190702064","86663870066039521727418255919552326102","314256850036134758323951290080596366464","220219526492087184458953272769147199137","165093016227150873477469915292418625590","162894790730708165948613955641610959328","157810175494564405746982253606562894870","17468574020700920036131210100277796520","152046673237317184151647504223554010268","312231909485644609421347732550229543255","147051055789832905086858288057732348102","97537098776705399385241603768498221272","65750720100972574770375484315699531357","247271166732082100339852560767641459749","318794263397201492285006657618571978560","207300763322786407989155847249617759869","134316332604957296142037134207403860419","184610229140695603052919631671092903987","86578794953454767213316565484646774427","133567664741154246708477062048139627638","258656019144658817273937687969793483003","11748214399927345547121365183069060679","266361201255571481104018247302037814286","100174861268760499475414815352810647283","96528508313428070211794072650737658704","278680649427755267041218029847847452983","89070779291284950049208047018434429002","245139906604154975476564223563666207937","300235810166576863330506804568234631764","55893752937822356344115640099028018929","147260018072290775697008114679157973198","188156301845832351738420892666906030967","107019298079373120598122962520370562119","254443069976850190677713377674760966241","75130744596077651951925423394904619178","251023423788675838939114526071584029949","78231383642105867997703575515450196816","198039834642316613900068931504379245615","202165735492959538095764542111515162395","246597209975803068596788263379703137544","56988981048426552676864500384781730344","333814185611026047036012343397235424664","140826564986880416284648290003087511997","139574992989877566209400272309535422925","158108807842159297317575753499125533116","157685452990308313593926241747320570543","160433385831166937391900281894342291707","25818552393907553153369899057421862729","165078429720844290892453520967687729499","186587297212827069633104091712998171941","299827067875356241453874599069669124218"]},"id":"CVE-2022-39309-165f5bb7","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"length":104,"function_hash":"157200952675823847501740174535573074992"},"id":"CVE-2022-39309-16eceafa","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"function":"GitMaterial","file":"domain/src/main/java/com/thoughtworks/go/config/materials/git/GitMaterial.java"}},{"deprecated":false,"digest":{"function_hash":"292228570049319300142520614230400018870","length":336},"id":"CVE-2022-39309-18a2e65e","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldCopyOverPasswordWhenConvertingToConfig"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldReturnAResolvedPassword_IfPasswordDefinedAsSecretParam"},"deprecated":false,"digest":{"length":361,"function_hash":"167229477957867861139265678330448871728"},"id":"CVE-2022-39309-1d2286dd"},{"signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"function":"P4Material","file":"domain/src/main/java/com/thoughtworks/go/config/materials/perforce/P4Material.java"},"deprecated":false,"digest":{"function_hash":"135633325882393141455786707048738426704","length":235},"id":"CVE-2022-39309-1dd1521c","signature_type":"Function"},{"source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"server/src/test-integration/java/com/thoughtworks/go/domain/materials/tfs/TfsMaterialPersistenceTest.java","function":"shouldBeAbleToConvertAMaterialInstanceObjectToTfsMaterialObject"},"deprecated":false,"digest":{"function_hash":"110485362356696338348781597224198401232","length":388},"id":"CVE-2022-39309-1f9d32bc","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"85851800730154254305521507985931747701","length":358},"id":"CVE-2022-39309-22449f26","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"function":"shouldEncryptSvnPasswordAndMarkPasswordAsNull","file":"common/src/test/java/com/thoughtworks/go/domain/materials/svn/SvnMaterialTest.java"}},{"id":"CVE-2022-39309-236d47fc","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/svn/SvnMaterial.java","function":"SvnMaterial"},"deprecated":false,"digest":{"function_hash":"448148164045385467053324982631523130","length":62}},{"id":"CVE-2022-39309-277c857e","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"setUp"},"deprecated":false,"digest":{"length":383,"function_hash":"93976210878413103161036914336237607982"}},{"target":{"function":"shouldReturnUrlForCommandLine_asUrl_IfSet","file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java"},"deprecated":false,"digest":{"function_hash":"87673166992075767051278773251757291005","length":384},"id":"CVE-2022-39309-2950219f","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/perforce/P4Material.java","function":"P4Material"},"deprecated":false,"digest":{"function_hash":"340205368583805846861689921645641634930","length":86},"id":"CVE-2022-39309-2e1c45b1"},{"digest":{"length":439,"function_hash":"63499816766274447705201421034058442640"},"id":"CVE-2022-39309-31eb06ec","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldErrorOutIfEncryptionFails"},"deprecated":false},{"id":"CVE-2022-39309-333a70a3","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldEncryptTfsPasswordAndMarkPasswordAsNull"},"deprecated":false,"digest":{"function_hash":"98471170503501759364139946842127876857","length":381}},{"source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldNotDecryptPasswordIfPasswordIsNotNull"},"deprecated":false,"digest":{"function_hash":"130481699210939739296665781479380518038","length":603},"id":"CVE-2022-39309-35c3e7ef","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/tfs/TfsMaterial.java"},"deprecated":false,"digest":{"line_hashes":["79347507244411893182630804628281669479","35526819237963896664563466602188680799","107684016481516447483207112514660094116","253953894019948662999522836383729930110","156018386467499443465017520236037912162","43670081857509368613206093662476606854","163664275249984274340040206679521887015","196879764109180617566520996630959601935","308261241862412089966695360223447863475","247856641860668950927233118371064868447","296822747122759875801653017674335339531","285438380551873813681523052842610910599","269884506740713705502350010419521703960","332300789708444723947353318615613502786","127324938553863695149099527432651322697","237697694745792808592538035627460524917"],"threshold":0.9},"id":"CVE-2022-39309-3d7c92be"},{"id":"CVE-2022-39309-3e06e5bc","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/mercurial/HgMaterial.java"},"deprecated":false,"digest":{"line_hashes":["269712907025405233892616612699611784336","133324546663025755687282910642016007782","251941911231846039286455044958420140343","220454735389746899249338629383127616457","291755392747576122049727601694378435585","301367198876430559168246535587543358037","266963837057380874180722048730697597895","43861220021924752644000620896571754185"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"server/src/test-integration/java/com/thoughtworks/go/domain/materials/tfs/TfsMaterialPersistenceTest.java","function":"shouldFindOldMaterial"},"deprecated":false,"digest":{"function_hash":"135187448394355081854305302274648548705","length":313},"id":"CVE-2022-39309-49421d76"},{"digest":{"function_hash":"192920477359021440089472063617047186686","length":53},"id":"CVE-2022-39309-4c9697df","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/perforce/P4Material.java","function":"P4Material"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"238062743274974419878448625738506909646","length":395},"id":"CVE-2022-39309-51b092b2","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/perforce/P4Material.java","function":"P4Material"}},{"source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"server/src/test-integration/java/com/thoughtworks/go/domain/materials/tfs/TfsMaterialPersistenceTest.java"},"deprecated":false,"digest":{"line_hashes":["91475453666831883758686569403084118931","337706359693310246206471338801055489082","75695368536062810326828318169902849216","77963374655356620858917784547266901782","114906203899653137580436934050934021374","322378665789477222177702218169895453642","323145234681453593824636924304565549753","163330840896891489292635646016263769145","220020023983092051520970414902407377997","266466192054850288304560185962831032287","17195888819075099735422593294923917499","24733771852106260880204672280112296883","278506799057093578698239933878499159423","309313348797272123088475534354327994339","176151661295327261926427290302442161042","222131482253398574449846066736527421559"],"threshold":0.9},"id":"CVE-2022-39309-56e56c08","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/ScmMaterial.java","function":"getEncryptedPassword"},"deprecated":false,"digest":{"function_hash":"220183740634577659619910932136173433987","length":49},"id":"CVE-2022-39309-62a9bc37","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"322010635653468372859898695560973321940","length":342},"id":"CVE-2022-39309-71dc12c6","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldInjectAllRelevantAttributesInSqlCriteriaMap"}},{"deprecated":false,"digest":{"function_hash":"7719963515099412970731791459362433897","length":313},"id":"CVE-2022-39309-73e83489","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldErrorOutWhenCalledOnAUnResolvedSecretParam_IfPasswordDefinedAsSecretParam"}},{"id":"CVE-2022-39309-7656052f","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/domain/materials/svn/SvnMaterialTest.java","function":"shouldErrorOutIfEncryptionFails"},"deprecated":false,"digest":{"function_hash":"308859442906343652876958465415068096048","length":416}},{"source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/Materials.java"},"deprecated":false,"digest":{"line_hashes":["229612394522216722804016153451704874821","75338256846740797883539910619370894288","195143269108362173622822318859613257991","335347760423687675124115295069226424185","101111256293221140776127062507833785068","92060839736559476897499575754649577226","187864672892150519743395361031103850166","175666797962506255404128489263495994743"],"threshold":0.9},"id":"CVE-2022-39309-8c2dfb33","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldReturnPasswordAsConfigured_IfNotDefinedAsSecretParam"},"deprecated":false,"digest":{"function_hash":"123941318138253003004750808137388567832","length":187},"id":"CVE-2022-39309-8f98ad81","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["326777238105995199716255677364367144834","65327321326524950956188015349728481409","181757559121039481975008641031871895917","51476103608440365012952328128122958033","295394403085898627181833320173664411948","177899009828380553504076001898126996229","130045168854308825004385534456933697160","259766284582881736336220302019566662521"],"threshold":0.9},"id":"CVE-2022-39309-9317a5b5","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/test/java/com/thoughtworks/go/helper/MaterialsMother.java"}},{"id":"CVE-2022-39309-97d49da7","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldParsePasswordString_IfDefinedAsSecretParam"},"deprecated":false,"digest":{"function_hash":"160461579501271233536789966554405577234","length":283}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"function":"shouldDecryptP4Password","file":"common/src/test/java/com/thoughtworks/go/config/materials/perforce/P4MaterialTest.java"},"deprecated":false,"digest":{"function_hash":"104827262708312345903563408300995585862","length":367},"id":"CVE-2022-39309-9a803d00"},{"target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/tfs/TfsMaterial.java","function":"TfsMaterial"},"deprecated":false,"digest":{"function_hash":"204968258390580890675845193284060816957","length":395},"id":"CVE-2022-39309-9bd340f4","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a"},{"id":"CVE-2022-39309-a1256652","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/svn/SvnMaterial.java","function":"SvnMaterial"},"deprecated":false,"digest":{"function_hash":"51382473269143999038599581467333573702","length":240}},{"id":"CVE-2022-39309-a3ba38a6","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/ScmMaterial.java","function":"currentPassword"},"deprecated":false,"digest":{"function_hash":"243150860420274761011955883236672603148","length":247}},{"deprecated":false,"digest":{"function_hash":"171272700192562651132477758780007418755","length":716},"id":"CVE-2022-39309-a8ee921a","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldGetAttributesWithoutSecureFields"}},{"id":"CVE-2022-39309-a9a2ac1f","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/domain/materials/svn/SvnMaterialTest.java","function":"shouldDecryptSvnPassword"},"deprecated":false,"digest":{"function_hash":"138758986216279856138692273128063533426","length":374}},{"target":{"file":"domain/src/main/java/com/thoughtworks/go/domain/materials/tfs/TfsMaterialInstance.java"},"deprecated":false,"digest":{"line_hashes":["91475453666831883758686569403084118931","42834651163110565258555652048876951271","325862978487511040529303537339703108299","2732267749081889117030168385625133696","285979836390704468498177291524900123764","171781916916298815400019374323348690479","39330780072067214539338929393707657125","278216960257681640456598601592491905135"],"threshold":0.9},"id":"CVE-2022-39309-aa137b7c","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a"},{"signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/perforce/P4Material.java","function":"P4Material"},"deprecated":false,"digest":{"function_hash":"141435690984725910954612271182451501702","length":161},"id":"CVE-2022-39309-ac4e0002","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/domain/materials/tfs/TfsMaterialInstance.java","function":"toOldMaterial"},"deprecated":false,"digest":{"function_hash":"315729244835533248267901235773366642583","length":239},"id":"CVE-2022-39309-ad815d3f","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/domain/materials/svn/SvnMaterialTest.java"},"deprecated":false,"digest":{"line_hashes":["100746148929913238590955083383106244074","281194824430549989049722839408132219049","150459777892018551929043283332378926056","335469973916123204474558344338147489204","335300781678202892829811330996928550256","278343403821535052718926115510473330285","83769822029205891413122562742751362672","268229031645776961606160327288886787125","232913399210144438810801804451890117312","283332770577179062432143227196969648833","178685491549837226229081455267417793396","44464786267241701043311197820328353141","202632097964027869280592061285933067595","302485722841608209785136917241158732124","9743162099844799717702828920585664313","85428953935903012598488839767193320131","142462904903165627526528570022712443143","122912966124759362548804404487982912692","76789357665999499524962897529758744507","157732016750133187124404227210252392433","289979994535587617496218921075637304454","130887925702074624373126822396191904278","56273584209409010210439540203303283307","327946365875129121600729189271987652673","118218800910743728421560466206999269491","82204184486691110501355753639518379537","235928953444419962272792013239784270618","197277118773837254662958376795321594273","267532610472225426352512855456654888906","86765208216220532622074114317378829488","322529030417271582847848757776691129356","208934683513551542057887544687729176968","94754199479608424961138761023658320723","192385989578003431555392772521301245683","213899592334596200003858634578977104491","191961642973451387386631917056992383576","281535222177910942838718553400076423063","200100826401228166503136958144857972722","284236897461940557272411880703862084472","107984951494472868701950425130375444237","288650426150346926517269157273326353964","329240873129317971326376635111399226203","297242277730354465988424696808725805385","113074403819513397236696027063625922662","249839101603971643945361061740031153401","67899445550103375164671394256938703435","215914117327048650588222672357338012851","213469244810337295740277680477174498719","307086790122296334793146929531323039997"],"threshold":0.9},"id":"CVE-2022-39309-b5e6e320"},{"deprecated":false,"digest":{"line_hashes":["327899113850710070222980237528909215476","303466836254586357110267272811114516690","210978662196159396500866072421118265091","237340780631738375906992454162661951594","174980017680912669240769538004692383994","8133887124744746605580300221786886997","196431194556348136806865564477914569090","141753010246733705818007348439766696789"],"threshold":0.9},"id":"CVE-2022-39309-b7b93606","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/domain/materials/TestingMaterial.java"}},{"source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldInjectAllRelevantAttributesInAttributeMap"},"deprecated":false,"digest":{"function_hash":"30582527641765256758149373543953799931","length":361},"id":"CVE-2022-39309-c860dbe1","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"255221764347738932764378889387366493263","length":126},"id":"CVE-2022-39309-c8ffc27f","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/ScmMaterial.java","function":"resetPassword"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"192920477359021440089472063617047186686","length":53},"id":"CVE-2022-39309-ca3acad6","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/tfs/TfsMaterial.java","function":"TfsMaterial"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java"},"deprecated":false,"digest":{"line_hashes":["252143506523574270523868142495681138104","263036301529423488235298544460337322086","19529898574970601752091561033564789276","42520329908637158190737788719690226386","241778159403202404208927990331259469605","154769252470921359544892038941491898800","125972558531858770814774015684996214958","35863406175280107439878311545754174155","316423782651039633597790127015370112365","315615125017351718868050231333379053153","121362171674040247300503168434678673764","246449173202044498717660842884961918342","151411609098342540578234991794406878290","98956149204067557483539995217501620454","321647569280872032560898806801859776037","114025482010971805611974495971235249237","6547889442312621628739132536318799669","130135308242588749991442134862653694205","98373521190495641505871524949572946901","31862238315021089309121695133645937768","279642163948040539063751305057964326099","196758074739356083834665986844899861721","275045213935759261682849014910205142724","123136947234619095097747526935548178609","121704420353860899177795943052876509873","283905523620318079005610804790460235680","118709171561104911728184958373752093733","187430842899933917842763986066282272053","201176221732566175572008216012236313082","300672409031042812780900567955927788158","31918753657476891229340005679897470208","13535271672852062352276366107095716215","174032299615924139622540583439984232131","101519457651446353274264817969177234036","18369440513481833461455178200777237656","280253220836389573281984372850786495634","238573050074376554526851550133585875371","324401822410468929170362734110684602883","320507517208323351248224291371245815227","279163200289307135882620123817324099619","117570707302403384008824225383997389389","73390466999622724044104870701465860756","267479391128002355509141854601854671733","184132433849400724724499600457295643268","205999483513538255405933175325416875123","50963544209460532514175430190500545548","269693789851418100975416565691482657749","73832109680666127529388901330087837771","159897225901686067661057672055905858797","213743602459903131458827992541990506610","120382164872142447320234525912690235755","273565699567780408707720461390323615523","14636597779584327546762724541363963739","234094987016176538348305276316502133648","130887925702074624373126822396191904278","56273584209409010210439540203303283307","327946365875129121600729189271987652673","118218800910743728421560466206999269491","82204184486691110501355753639518379537","247760160915663044190684510368278550639","103330655215287443586886360451558171200","78370717653341536034982871022767273082","336031860335661601354127410409220642931","322529030417271582847848757776691129356","208934683513551542057887544687729176968","94754199479608424961138761023658320723","192385989578003431555392772521301245683","213899592334596200003858634578977104491","191961642973451387386631917056992383576","281535222177910942838718553400076423063","200100826401228166503136958144857972722","284236897461940557272411880703862084472","107984951494472868701950425130375444237","100808088138569621299362568656153616030","119439332168530225301142893975335348117","302215607017569459896744578367151144897","101713966313240130768247678644122272225","249839101603971643945361061740031153401","67899445550103375164671394256938703435","215914117327048650588222672357338012851","97670179608811288149223739603006454708","202122618647880811714378568296037040460","144995446180738680045663843237117443712","111445865719066236099971531083246435044","201501267080249763313619207006244645417","73386681180368111344552584649388437729","5054483812104200006549272214006122066","278626449870696087484024034578837819284","154139184610003509504742646356164963486","252045510771300084350607399062950458173","73756625064893527522702231495161082574","4262584512026851715576594260696923994","21430012814418739579789542320798169071","224624206660273039173845883030004020499","247751010301575858286018275784271205230","283718115166544238558631522629921280051","304915514055278435505098012426906690865","80729943679929482392007943434950276032","340008990584642339961206243273973501064","99766183360868769561936547260098305629","62489751251828847908360514692036620732","223699971985087108495836665088537905205","195486424860192894075143530938435188314","272799695597973594334049506099786633988","235156954289053901951889512061621733649","52612430766701275114860370035345625185","177892654003723556821872358981781661480","290820945596722988871781487855242219517","293267384388437489408377922010409917208","178167225904537239993979453836251257427","333620375883593502190138203445685602847","279391231680784869969758739705298856075","161863001225551178060738977032760739891","201798124058603807901677677287993550752","288375082719433235134016129917173033337","41436107150145383360917473154659495325","180281076502022247228349798662084699372","119594837804622542928086195847665158807","146552097573102389180634359776505069573","266916141200302623556941637126818838719"],"threshold":0.9},"id":"CVE-2022-39309-cf074633"},{"digest":{"function_hash":"246287992430446896379068520618193487545","length":287},"id":"CVE-2022-39309-d0446cb1","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"server/src/test-integration/java/com/thoughtworks/go/domain/materials/tfs/TfsMaterialPersistenceTest.java","function":"shouldSaveMaterialInstance"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"162488435343386003523383677150166623089","length":387},"id":"CVE-2022-39309-d36771fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldReturnUrlForCommandLine_asLocation_IfSet"}},{"id":"CVE-2022-39309-d4391181","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"function":"shouldEncryptP4Password","file":"common/src/test/java/com/thoughtworks/go/config/materials/perforce/P4MaterialTest.java"},"deprecated":false,"digest":{"function_hash":"177662922780611028688594176085113892462","length":377}},{"target":{"function":"shouldDecryptTfsPassword","file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java"},"deprecated":false,"digest":{"function_hash":"278145299168315997604780462790889815926","length":397},"id":"CVE-2022-39309-d7e01ef5","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/perforce/P4Material.java"},"deprecated":false,"digest":{"line_hashes":["43859640361948587680345381451847444223","228540308776736288828885346195926218164","227495125510195112768472498017643547680","170169389271344620375070462431218039299","66789457987416513596732412488631876343","94380977585839405175569808603103413461","421066440281468795816232959103480488","281813117457393308004076677887308313113","183579611855037086531684110133410749451","145989689084822116871201982083064761006","20266041457553113108195513963182978466","331312184319839805886427343081817736276","316145184643756789160073211207611818912","331400746377366003328938775787753939336","62760433284548084498219555684379378247","115412915027881111966575498167157520193","137557100821873596473580075316741956181","67680183646603749470006188559791898193","286719892489787484638836829571298861295","255143210530698119595461171351218656667","114591545338496953153271564903738642250","147893498776429017567125536690959788014","319091150961455283820364140923134961621","160311735312232127202845256701338927757","8843827509716249136695535662430299714","247401986678974124719467140263704700190","108853936244435959416125751185931557049","324077957348451516184787618091571692704","281813117457393308004076677887308313113"],"threshold":0.9},"id":"CVE-2022-39309-d8ad1120"},{"id":"CVE-2022-39309-dda6d52c","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"server/src/test-fast/java/com/thoughtworks/go/server/service/MaterialServiceTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["71929165014338667277437115987594746028","231713997539770847365449621342458048777","215213743715755558965512734588244085183","291101878397484521050418487084577547058","256454780731528818694576286541463435039","92527623767064320374997630477524805503","160815003665092950501087272429010776864","263372466172935041096194004593278623649"]}},{"deprecated":false,"digest":{"function_hash":"285738133661736457736552440106417709999","length":52},"id":"CVE-2022-39309-de913d1a","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/domain/materials/TestingMaterial.java","function":"TestingMaterial"}},{"target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/tfs/TfsMaterial.java","function":"TfsMaterial"},"deprecated":false,"digest":{"function_hash":"88367755706274366463091437269329216312","length":228},"id":"CVE-2022-39309-e524bb94","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a"},{"deprecated":false,"digest":{"function_hash":"38634429221084555970377149038047343407","length":470},"id":"CVE-2022-39309-e5fb0e09","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/ScmMaterial.java","function":"setPasswordIfNotBlank"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/domain/materials/DummyMaterial.java"},"deprecated":false,"digest":{"line_hashes":["327899113850710070222980237528909215476","303466836254586357110267272811114516690","210978662196159396500866072421118265091","3351281744572850569237718622558107928","192526493401080356075210151154808254809","175965802209462600562993458765947351522","69754151601862959735133162651643080866","155269276594153317141396279054474369028"],"threshold":0.9},"id":"CVE-2022-39309-e96c6297"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["204347025585176998082730005092153422150","158896475563445253145307906940425792168","174132471739571905231574927439987135603","305072735175244933909759295058427492437","273503784082137450804451853191943183085"]},"id":"CVE-2022-39309-ebfcef12","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/server/service/MagicalMaterialAndMaterialConfigConversionTest.java"}},{"deprecated":false,"digest":{"line_hashes":["240760863449398630494079779593457665472","203235807766771474224302915760370931786","183511058792144570842492522656357277340","291933848381279796517852195501987587490","267719768401127859506783179941642474980","96801918221796585054268169435611017215","128045205418747010636965594786761936280","314416812116589926507552588513646481244","326040712319596435431547309317034399851","263454244834862829787601533335816919682"],"threshold":0.9},"id":"CVE-2022-39309-eec7b056","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"domain/src/main/java/com/thoughtworks/go/config/materials/svn/SvnMaterial.java"}},{"deprecated":false,"digest":{"function_hash":"245898156365934650101622385712920739670","length":526},"id":"CVE-2022-39309-f5032691","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/domain/materials/svn/SvnMaterialTest.java","function":"shouldErrorOutIfDecryptionFails"}},{"id":"CVE-2022-39309-f659a8bd","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"function":"shouldOnlyPopulateDomainEnvVarIfPresent","file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java"},"deprecated":false,"digest":{"function_hash":"68430426112105901719988264839202054843","length":677}},{"deprecated":false,"digest":{"function_hash":"96448758032402162430945122653112252025","length":728},"id":"CVE-2022-39309-fa02f2af","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a","target":{"file":"common/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialTest.java","function":"shouldGetAttributesWithSecureFields"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}]}