When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.
When dscreate is executed in verbose mode, it prints Directory Manager's password to stderr. The same happens with dsconf when I change the password.
Version-Release number of selected component (if applicable):
389-ds-base-1.4.0.19-2.
How reproducible:
always
Steps to Reproduce:
1. dscreate -v interactive
2. dsconf -v localhost directory_manager password_change
Actual results:
# dscreate -v interactive
...
DEBUG: cn=config set REPLACE: ('nsslapd-rootpw', 'Directory_Manager_Password')
# dsconf -v localhost directory_manager password_change
...
Enter new directory manager password :
CONFIRM - Enter new directory manager password :
DEBUG: cn=config set REPLACE: ('nsslapd-rootpw', 'new_password')
Expected results:
Actual value should not be printed in the debug logs. Python logging module supports filters that should be used to redact sensitive information from the logs
Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=1654059
When dscreate is executed in verbose mode, it prints Directory Manager's password to stderr. The same happens with dsconf when I change the password. Version-Release number of selected component (if applicable): 389-ds-base-1.4.0.19-2. How reproducible: always Steps to Reproduce: 1. dscreate -v interactive 2. dsconf -v localhost directory_manager password_change Actual results: # dscreate -v interactive ... DEBUG: cn=config set REPLACE: ('nsslapd-rootpw', 'Directory_Manager_Password') # dsconf -v localhost directory_manager password_change ... Enter new directory manager password : CONFIRM - Enter new directory manager password : DEBUG: cn=config set REPLACE: ('nsslapd-rootpw', 'new_password') Expected results: Actual value should not be printed in the debug logs. Python logging module supports filters that should be used to redact sensitive information from the logs Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1654059