Bug 856960

Summary:	abrt should not log the uploader plugin credentials
Product:	Red Hat Enterprise Linux 6	Reporter:	Jiri Moskovcak <jmoskovc>
Component:	libreport	Assignee:	abrt <abrt-devel-list>
Status:	CLOSED ERRATA	QA Contact:	Lukáš Zachar <lzachar>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.4	CC:	collura, dfediuck, dkutalek, mnowak, nobody+abrt-devel-list, nstrug
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	libreport-2.0.9-9.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-02-21 07:54:18 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jiri Moskovcak 2012-09-13 08:47:54 UTC

Description of problem:

When abrt on RHEL6.3 (with abrt-addon-vmcore + kdump installed) copies a kernel 
core to a centralised server it dumps the following info in clear text into /var/log/messages:

                                 #   #   #
Sep 12 14:47:02 ipa abrtd: Successfully sent /tmp/abrt-upload-2012-09-11-14:46:28-2528.tar.gz to scp://root:password.0.1/var/spool/abrt-upload/vmcore-ipa.redhat.local.tar.gz

- I believe we can strip the part before '@' and print only the path

Comment 6 Jiri Moskovcak 2013-01-24 15:45:41 UTC

Cause
    The logging message contained a login and password
Consequence
    The login and password used for uploading reports to ftp were visible in syslog
Fix
    Don't print the login/password in log messages
Result
    Login and password is not visible in syslog

Comment 7 errata-xmlrpc 2013-02-21 07:54:18 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0290.html