| Summary: | No password validation for basic(default) authentication | ||
|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | Oleksandr Shtaier <oshtaier> |
| Component: | Security | Assignee: | Katello Bug Bin <katello-bugs> |
| Status: | CLOSED DUPLICATE | QA Contact: | Kedar Bidarkar <kbidarka> |
| Severity: | urgent | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.1.6 | CC: | kbidarka, mmccune |
| Target Milestone: | Unspecified | ||
| Target Release: | Unused | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-01-19 00:05:37 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
*** This bug has been marked as a duplicate of bug 1264137 *** |
Description of problem: On one hand - that issue has more references to user management functionality, but as it is directly impact user password aspects, it was decided to treat mentioned problem as security one. Reproduced from both UI and CLI stand points Create User issues: - There are no validation on length of the password - You can specify very long passwords that directly impact performance of application (for example, tried to create user with password that has length more than 30000 of symbols and put browser in non-responsive state for more than 30 seconds. Each following action will hang browser for more than 30 seconds). Of course, there are no limit - You can specify very small passwords (like 1 symbol). - It is possible to use any character (even whitespace) in the password and in any sequence (like 'aaaaaaa'). Even more, password - 'aaaaaaaaaaaaaaaaaaaa' - treated as 'Very Strong' one! - It is possible to use dictionary words Update User issues: Same as for create user + - It is possible to use empty password in update procedure. For example, using hammer: ``` hammer -u xxxxx -p xxxxx user update --id 5 --password '' User updated ``` - It is possible to use previous password(s). Version-Release number of selected component (if applicable): 6.1.6 (but probably every version) How reproducible: Always Steps to Reproduce: 1. Try to Create/Update user with different passwords Actual results: No password validation Expected results: At least basic rules are used: Length 8-50 characters At least one uppercase letter At least one lowercase letter At least one number At least one special character ('~ ! @ # $ % ^ & * ( ) _ - + = { } [ ] \ | : ; " ' < > , . ? /') No previous passwords (at least last one) cannot be used for update user procedure Proper representation in UI (like what passwords is weak and what password is very strong) Additional info: