Bug 1730668

Summary: CVE-2019-14825 katello: Registry credentials are captured in plain text in dynflow task during repository discovery [rhn_satellite_6-default]
Product: Red Hat Satellite Reporter: hprakash
Component: RepositoriesAssignee: Justin Sherrill <jsherril>
Status: CLOSED ERRATA QA Contact: vijsingh
Severity: low Docs Contact:
Priority: low    
Version: 6.5.0CC: cbuissar, dmoppert, egolov
Target Milestone: 6.6.0Keywords: Security, SecurityTracking, Triaged
Target Release: Unused   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: tfm-rubygem-katello-3.12.0.9-1 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-10-22 12:47:55 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 1739485    
Attachments:
Description Flags
Screenshot none

Comment 3 Justin Sherrill 2019-07-31 15:14:58 UTC
Created redmine issue https://projects.theforeman.org/issues/27485 from this bug

Comment 4 Bryan Kearney 2019-07-31 16:04:17 UTC
Upstream bug assigned to jsherril@redhat.com

Comment 5 Bryan Kearney 2019-07-31 16:04:18 UTC
Upstream bug assigned to jsherril@redhat.com

Comment 6 Bryan Kearney 2019-08-01 16:04:11 UTC
Moving this bug to POST for triage into Satellite 6 since the upstream issue https://projects.theforeman.org/issues/27485 has been resolved.

Comment 8 vijsingh 2019-08-19 06:56:45 UTC
ON_QA Verified:

@Satellite 6.6.0 snap 16.0

Steps/Observations:

 1. Logged in to Satellite WebUI
 2. Content> Products> Repo Discovery
 3. Selected 'Container Images' for 'Repository Type'
 4. Selected 'Red Hat registry'
 5. Entered registry username and password
 6. click on 'Discover'
 7. Checked the relevant task on the tasks page and verify the dynflow console, 
    the action Actions::Katello::Repository::Discover shows the input parameters 
    which contains upstream_password in encrypted way.


Attached screenshot.

Comment 9 vijsingh 2019-08-19 06:57:39 UTC
Created attachment 1605653 [details]
Screenshot

Comment 10 Doran Moppert 2019-09-04 03:51:00 UTC
*** Bug 1748729 has been marked as a duplicate of this bug. ***

Comment 13 errata-xmlrpc 2019-10-22 12:47:55 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:3172