Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionOleksandr Shtaier
2016-01-18 11:24:37 UTC
Description of problem:
On one hand - that issue has more references to user management functionality, but as it is directly impact user password aspects, it was decided to treat mentioned problem as security one.
Reproduced from both UI and CLI stand points
Create User issues:
- There are no validation on length of the password
- You can specify very long passwords that directly impact performance of application (for example, tried to create user with password that has length more than 30000 of symbols and put browser in non-responsive state for more than 30 seconds. Each following action will hang browser for more than 30 seconds). Of course, there are no limit
- You can specify very small passwords (like 1 symbol).
- It is possible to use any character (even whitespace) in the password and in any sequence (like 'aaaaaaa'). Even more, password - 'aaaaaaaaaaaaaaaaaaaa' - treated as 'Very Strong' one!
- It is possible to use dictionary words
Update User issues:
Same as for create user
+
- It is possible to use empty password in update procedure.
For example, using hammer:
```
hammer -u xxxxx -p xxxxx user update --id 5 --password ''
User updated
```
- It is possible to use previous password(s).
Version-Release number of selected component (if applicable):
6.1.6 (but probably every version)
How reproducible:
Always
Steps to Reproduce:
1. Try to Create/Update user with different passwords
Actual results:
No password validation
Expected results:
At least basic rules are used:
Length 8-50 characters
At least one uppercase letter
At least one lowercase letter
At least one number
At least one special character ('~ ! @ # $ % ^ & * ( ) _ - + = { } [ ] \ | : ; " ' < > , . ? /')
No previous passwords (at least last one) cannot be used for update user procedure
Proper representation in UI (like what passwords is weak and what password is very strong)
Additional info:
Description of problem: On one hand - that issue has more references to user management functionality, but as it is directly impact user password aspects, it was decided to treat mentioned problem as security one. Reproduced from both UI and CLI stand points Create User issues: - There are no validation on length of the password - You can specify very long passwords that directly impact performance of application (for example, tried to create user with password that has length more than 30000 of symbols and put browser in non-responsive state for more than 30 seconds. Each following action will hang browser for more than 30 seconds). Of course, there are no limit - You can specify very small passwords (like 1 symbol). - It is possible to use any character (even whitespace) in the password and in any sequence (like 'aaaaaaa'). Even more, password - 'aaaaaaaaaaaaaaaaaaaa' - treated as 'Very Strong' one! - It is possible to use dictionary words Update User issues: Same as for create user + - It is possible to use empty password in update procedure. For example, using hammer: ``` hammer -u xxxxx -p xxxxx user update --id 5 --password '' User updated ``` - It is possible to use previous password(s). Version-Release number of selected component (if applicable): 6.1.6 (but probably every version) How reproducible: Always Steps to Reproduce: 1. Try to Create/Update user with different passwords Actual results: No password validation Expected results: At least basic rules are used: Length 8-50 characters At least one uppercase letter At least one lowercase letter At least one number At least one special character ('~ ! @ # $ % ^ & * ( ) _ - + = { } [ ] \ | : ; " ' < > , . ? /') No previous passwords (at least last one) cannot be used for update user procedure Proper representation in UI (like what passwords is weak and what password is very strong) Additional info: