Bug 906201 (CVE-2012-6117)
| Summary: | CVE-2012-6117 Aeolus Configserver: Passwords from application blueprint stored plaintext in configserver.log | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Kurt Seifried <kseifried> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | cpelland, dajohnso, gblomqui, jeckersb, mmccune, morazi, security-response-team, slinaber, srevivo |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | aeolus-configserver-0.4.12-3.el6cf | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-08-21 21:04:58 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 872300, 891388 | ||
| Bug Blocks: | 906635 | ||
Acknowledgements: This issue was discovered by James Laska of Red Hat. #1 is addressed: ll /var/log/aeolus-configserver/configserver.log -rw-------. 1 aeolus aeolus 282 Feb 19 11:34 /var/log/aeolus-configserver/configserver.log Using 'aeolus-configserver-0.4.12-3.el6cf.noarch', when launching applications that require service orchestration, I'm no longer seeing passwords exposed in the configserver.log > # grep -rin pass /var/log/aeolus-configserver > # Marking this as VERIFIED based on comment#2 and comment#3 This issue has been addressed in following products: CloudForms for RHEL 6 Via RHSA-2013:0545 https://rhn.redhat.com/errata/RHSA-2013-0545.html The Red Hat Security Response Team has rated this issue as having low security impact in CloudForms 1.1. This issue is not currently planned to be addressed in future updates. |
James Laska of Red Hat reports: Aeolus Configserver stores passwords in a plain/text world-readable log file. Version-Release number of selected component (if applicable): * aeolus-configserver-0.4.11-1.el6cf.noarch How reproducible: Steps to Reproduce: 1. Setup a configserver and connect it to conductor 2. Launch applications that rely on <parameter> with <value type="password"> <parameter name="KATELLO_PASS"> <value type="password">jlaska</value> </parameter> 3. Inspect /var/log/aeolus-configserver/configserver.log after launching instances Actual results: 1. The logfile is world readable > # ll /var/log/aeolus-configserver/configserver.log > -rw-r--r--. 1 aeolus aeolus 23611 Nov 1 12:43 /var/log/aeolus-configserver/configserver.log 2. The password is displayed in the logfile > I, [2012-11-01T07:51:06.875595 #1886] INFO -- : services: #<OrderedHash {"RHEL_PRODUCT_CERT"=>{}, "KATELLO_REGISTER"=>{"RELEASEVER"=>"5.7", "YUM_REMOTE_INSTALL"=>"mc vte", "SSH_TUNNEL_GOFER_PORT"=>"5674", "KATELLO_PASS"=>"jlaska", "KATELLO_ORG"=>"redhat", "JENKINS_SSH_KEY_LOCATION"=>"None", "IMPORT_GPG_BETA_KEY"=>"True", "SSH_TUNNEL_KATELLO_PORT"=>"1443", "AUTO_SUBSCRIBE"=>"True", "ACTIVATION_KEY"=>"None", "RHEL_PRODUCT_CERT_TASK"=>"RHEL_PRODUCT_CERT", "JENKINS_SSH_DIR"=>"/root/.ssh", "KATELLO_ENV"=>"Dev", "SSH_TUNNEL_IP"=>"10.198.37.67", "DISABLE_RHUI"=>"True", "KATELLO_USER"=>"jlaska", "SSH_TUNNEL_ENABLED"=>"Auto", "YUM_LOCAL_INSTALL"=>"emacs", "KATELLO_PORT"=>"443", "KATELLO_HOST"=>"qeblade41.rhq.lab.eng.bos.redhat.com"}}> > I, [2012-11-01T09:02:55.129272 #1886] INFO -- : services: #<OrderedHash {"RHEL_PRODUCT_CERT"=>{}, "KATELLO_REGISTER"=>{"RELEASEVER"=>"5.7", "YUM_REMOTE_INSTALL"=>"mc vte", "SSH_TUNNEL_GOFER_PORT"=>"5674", "KATELLO_PASS"=>"jlaska", "KATELLO_ORG"=>"redhat", "JENKINS_SSH_KEY_LOCATION"=>"None", "IMPORT_GPG_BETA_KEY"=>"True", "SSH_TUNNEL_KATELLO_PORT"=>"1443", "AUTO_SUBSCRIBE"=>"True", "ACTIVATION_KEY"=>"None", "RHEL_PRODUCT_CERT_TASK"=>"RHEL_PRODUCT_CERT", "JENKINS_SSH_DIR"=>"/root/.ssh", "KATELLO_ENV"=>"Dev", "SSH_TUNNEL_IP"=>"10.198.37.67", "DISABLE_RHUI"=>"True", "KATELLO_USER"=>"jlaska", "SSH_TUNNEL_ENABLED"=>"Auto", "YUM_LOCAL_INSTALL"=>"emacs", "KATELLO_PORT"=>"443", "KATELLO_HOST"=>"qeblade41.rhq.lab.eng.bos.redhat.com"}}> > I, [2012-11-01T09:02:55.940862 #1886] INFO -- : services: #<OrderedHash {"RHEL_PRODUCT_CERT"=>{}, "KATELLO_REGISTER"=>{"RELEASEVER"=>"5.7", "YUM_REMOTE_INSTALL"=>"mc vte", "SSH_TUNNEL_GOFER_PORT"=>"5674", "KATELLO_PASS"=>"jlaska", "KATELLO_ORG"=>"redhat", "JENKINS_SSH_KEY_LOCATION"=>"None", "IMPORT_GPG_BETA_KEY"=>"True", "SSH_TUNNEL_KATELLO_PORT"=>"1443", "AUTO_SUBSCRIBE"=>"True", "ACTIVATION_KEY"=>"None", "RHEL_PRODUCT_CERT_TASK"=>"RHEL_PRODUCT_CERT", "JENKINS_SSH_DIR"=>"/root/.ssh", "KATELLO_ENV"=>"Dev", "SSH_TUNNEL_IP"=>"10.198.37.67", "DISABLE_RHUI"=>"True", "KATELLO_USER"=>"jlaska", "SSH_TUNNEL_ENABLED"=>"Auto", "YUM_LOCAL_INSTALL"=>"emacs", "KATELLO_PORT"=>"443", "KATELLO_HOST"=>"qeblade41.rhq.lab.eng.bos.redhat.com"}}> > I, [2012-11-01T09:20:09.888861 #1886] INFO -- : services: #<OrderedHash {"RHEL_PRODUCT_CERT"=>{}, "KATELLO_REGISTER"=>{"RELEASEVER"=>"5.7", "YUM_REMOTE_INSTALL"=>"mc vte", "SSH_TUNNEL_GOFER_PORT"=>"5674", "KATELLO_PASS"=>"jlaska", "KATELLO_ORG"=>"redhat", "JENKINS_SSH_KEY_LOCATION"=>"None", "IMPORT_GPG_BETA_KEY"=>"True", "SSH_TUNNEL_KATELLO_PORT"=>"1443", "AUTO_SUBSCRIBE"=>"True", "ACTIVATION_KEY"=>"None", "RHEL_PRODUCT_CERT_TASK"=>"RHEL_PRODUCT_CERT", "JENKINS_SSH_DIR"=>"/root/.ssh", "KATELLO_ENV"=>"Dev", "SSH_TUNNEL_IP"=>"10.198.37.67", "DISABLE_RHUI"=>"True", "KATELLO_USER"=>"jlaska", "SSH_TUNNEL_ENABLED"=>"Auto", "YUM_LOCAL_INSTALL"=>"emacs", "KATELLO_PORT"=>"443", "KATELLO_HOST"=>"qeblade41.rhq.lab.eng.bos.redhat.com"}}> > I, [2012-11-01T12:14:59.012779 #1886] INFO -- : services: #<OrderedHash {"RHEL_PRODUCT_CERT"=>{}, "KATELLO_REGISTER"=>{"RELEASEVER"=>"Auto", "YUM_REMOTE_INSTALL"=>"mc vte", "SSH_TUNNEL_GOFER_PORT"=>"5674", "KATELLO_PASS"=>"Redhat@1234", "KATELLO_ORG"=>"redhat", "JENKINS_SSH_KEY_LOCATION"=>"None", "IMPORT_GPG_BETA_KEY"=>"True", "SSH_TUNNEL_KATELLO_PORT"=>"1443", "AUTO_SUBSCRIBE"=>"True", "ACTIVATION_KEY"=>"None", "RHEL_PRODUCT_CERT_TASK"=>"RHEL_PRODUCT_CERT", "JENKINS_SSH_DIR"=>"/root/.ssh", "KATELLO_ENV"=>"Dev", "SSH_TUNNEL_IP"=>"10.198.37.67", "DISABLE_RHUI"=>"True", "KATELLO_USER"=>"admin", "SSH_TUNNEL_ENABLED"=>"Auto", "YUM_LOCAL_INSTALL"=>"emacs", "KATELLO_PORT"=>"443", "KATELLO_HOST"=>"qeblade40.rhq.lab.eng.bos.redhat.com"}}> > I, [2012-11-01T12:43:46.211550 #1886] INFO -- : services: #<OrderedHash {"RHEL_PRODUCT_CERT"=>{}, "KATELLO_REGISTER"=>{"RELEASEVER"=>"Auto", "YUM_REMOTE_INSTALL"=>"mc vte", "SSH_TUNNEL_GOFER_PORT"=>"5674", "KATELLO_PASS"=>"admin", "KATELLO_ORG"=>"redhat", "JENKINS_SSH_KEY_LOCATION"=>"None", "IMPORT_GPG_BETA_KEY"=>"True", "SSH_TUNNEL_KATELLO_PORT"=>"1443", "AUTO_SUBSCRIBE"=>"True", "ACTIVATION_KEY"=>"None", "RHEL_PRODUCT_CERT_TASK"=>"RHEL_PRODUCT_CERT", "JENKINS_SSH_DIR"=>"/root/.ssh", "KATELLO_ENV"=>"Dev", "SSH_TUNNEL_IP"=>"10.198.37.67", "DISABLE_RHUI"=>"True", "KATELLO_USER"=>"admin", "SSH_TUNNEL_ENABLED"=>"Auto", "YUM_LOCAL_INSTALL"=>"emacs", "KATELLO_PORT"=>"443", "KATELLO_HOST"=>"qeblade41.rhq.lab.eng.bos.redhat.com"}}> Expected results: 1. The configserver log should not be world-readable 2. <parameters> with a <value> of type="password" should be obfuscated when displayed in a logfile. Additional info: