Red Hat Bugzilla – Bug 1424885
Password written in clear text in heat-api.log with DEBUG mode [openstack-9]
Last modified: 2017-06-14 11:37:56 EDT
+++ This bug was initially created as a clone of Bug #1424879 +++ Description of problem: Reported by Hans Feldt, Ericsson Password written in clear text in heat-api.log with DEBUG mode Because this is debug, it is a hardening issue; no CVE is attached. Upstream bug: https://bugs.launchpad.net/heat/+bug/1664792 Affected code: heat/common/serializers.py: 31 class JSONResponseSerializer(object): 32 33 def to_json(self, data): 34 def sanitizer(obj): 35 if isinstance(obj, datetime.datetime): 36 return obj.isoformat() 37 return six.text_type(obj) 38 39 response = jsonutils.dumps(data, default=sanitizer) 40 LOG.debug("JSON response : %s" % response) # <- HERE Version-Release number of selected component (if applicable): openstack-heat-6.0.0-11.el7ost Steps to Reproduce: 1. Create overcloud 2. View /var/log/heat/heat-api.log 3. Grep for AdminPassword Actual results: Plain text is used for passwords Expected results: Plain text should never be used for passwords
keystone_authtoken.admin_passwo rd = **** log_opt_values /usr/lib/python2.7/site-packages/oslo_config/cfg.py:252 9
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2017:1464