Bug 1379909 – CVE-2016-7060 Red Hat QCI: qci exposes password in web UI when they should be masked

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1379909 - (CVE-2016-7060) CVE-2016-7060 Red Hat QCI: qci exposes password in web UI when they should be masked

Summary:	CVE-2016-7060 Red Hat QCI: qci exposes password in web UI when they should be...

Status:	CLOSED ERRATA

Aliases:	CVE-2016-7060

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20170110,repor...
Keywords:	Security

Depends On:	1390813 1396744
Blocks:	1379910
	Show dependency tree / graph

Reported:	2016-09-28 00:18 EDT by Kurt Seifried
Modified:	2017-03-06 14:51 EST (History)
CC List:	9 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:	It was found that several password fields in QCI failed to properly mask the password while it was being entered. An attacker with physical access or the ability to view the screen would be able to see the passwords as they are being entered, allowing them to later access accounts and services protected by those passwords.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-03-06 14:51:03 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2017:0256	normal	SHIPPED_LIVE	Moderate: tfm-rubygem-fusor_ui security update	2017-02-06 20:27:34 EST

Groups: None (edit)

Description Kurt Seifried 2016-09-28 00:18:13 EDT

The QCI QE Team of Red Hat reports:

In multiple locations within the web interface for QCI the password is shown 
by default when it should be masked by default.

Comment 1 Kurt Seifried 2016-09-28 00:18:19 EDT

Acknowledgments:

Name: QCI QE Team (Red Hat)

Comment 4 errata-xmlrpc 2017-02-06 15:27:52 EST

This issue has been addressed in the following products:

  QCI 1.0

Via RHSA-2017:0256 https://access.redhat.com/errata/RHSA-2017:0256

Note You need to log in before you can comment on or make changes to this bug.