Bug 1645263
| Summary: | Auth plugins leave passwords in the access log and audit log using REST [rhel-7.6.z] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Oneata Mircea Teodor <toneata> |
| Component: | pki-core | Assignee: | Dinesh Prasanth <dmoluguw> |
| Status: | CLOSED ERRATA | QA Contact: | Asha Akkiangady <aakkiang> |
| Severity: | high | Docs Contact: | Marc Muehlfeld <mmuehlfe> |
| Priority: | high | ||
| Version: | 7.6 | CC: | akahat, ascheel, cfu, cpelland, dmoluguw, edewata, jmagne, mharmsen, msauton, nkinder |
| Target Milestone: | rc | Keywords: | TestCaseProvided, ZStream |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | pki-core-10.5.9-8.el7_6 | Doc Type: | Bug Fix |
| Doc Text: |
Previously, the Certificate System REST API did not filter out plain password values. As a consequence, passwords were visible in clear text in log files. With this update, the server replaces password attribute values with "(sensitive)". As a result, clear text passwords are no longer visible in logs.
|
Story Points: | --- |
| Clone Of: | 1617894 | Environment: | |
| Last Closed: | 2019-01-29 17:21:57 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1617894 | ||
| Bug Blocks: | |||
|
Description
Oneata Mircea Teodor
2018-11-01 18:42:30 UTC
Test Procedure: * https://bugzilla.redhat.com/show_bug.cgi?id=1617894#c3 commit b53d4f5f135432d6bc25b4bc0def1ea4b44705a4
Author: Dinesh Prasanth M K <SilleBille.github.com>
Date: Mon Oct 1 16:25:08 2018 -0400
Fixes password leak of Auth plugins to Audit Logs (#57)
* Auth plugin adds `(sensitive)` instead of plain passwords
to AuditLogs
* Added generic `isSensitive()` to identify Passwords before logging
Signed-off-by: Dinesh Prasanth M K <dmoluguw>
(cherry picked from commit cc2b50fac7542476aef222ab5f1d49d86e38cba1)
(In reply to Matthew Harmsen from comment #3) > commit b53d4f5f135432d6bc25b4bc0def1ea4b44705a4 > Author: Dinesh Prasanth M K <SilleBille.github.com> > Date: Mon Oct 1 16:25:08 2018 -0400 > > Fixes password leak of Auth plugins to Audit Logs (#57) > > * Auth plugin adds `(sensitive)` instead of plain passwords > to AuditLogs > * Added generic `isSensitive()` to identify Passwords before logging > > Signed-off-by: Dinesh Prasanth M K <dmoluguw> > > (cherry picked from commit cc2b50fac7542476aef222ab5f1d49d86e38cba1) Cherry-picked to DOGTAG_10_5_9_RHEL_BRANCH DOGTAG_10_5_BRANCH:
commit cc2b50fac7542476aef222ab5f1d49d86e38cba1
Author: Dinesh Prasanth M K <SilleBille.github.com>
Date: Mon Oct 1 16:25:08 2018 -0400
Fixes password leak of Auth plugins to Audit Logs (#57)
* Auth plugin adds `(sensitive)` instead of plain passwords
to AuditLogs
* Added generic `isSensitive()` to identify Passwords before logging
Signed-off-by: Dinesh Prasanth M K <dmoluguw>
DOGTAG_10_5_RHEL_BRANCH:
commit b53d4f5f135432d6bc25b4bc0def1ea4b44705a4
Author: Dinesh Prasanth M K <SilleBille.github.com>
Date: Mon Oct 1 16:25:08 2018 -0400
Fixes password leak of Auth plugins to Audit Logs (#57)
* Auth plugin adds `(sensitive)` instead of plain passwords
to AuditLogs
* Added generic `isSensitive()` to identify Passwords before logging
Signed-off-by: Dinesh Prasanth M K <dmoluguw>
(cherry picked from commit cc2b50fac7542476aef222ab5f1d49d86e38cba1)
(In reply to Matthew Harmsen from comment #6) > DOGTAG_10_5_RHEL_BRANCH: > > commit b53d4f5f135432d6bc25b4bc0def1ea4b44705a4 > Author: Dinesh Prasanth M K <SilleBille.github.com> > Date: Mon Oct 1 16:25:08 2018 -0400 > > Fixes password leak of Auth plugins to Audit Logs (#57) > > * Auth plugin adds `(sensitive)` instead of plain passwords > to AuditLogs > * Added generic `isSensitive()` to identify Passwords before logging > > Signed-off-by: Dinesh Prasanth M K <dmoluguw> > > (cherry picked from commit cc2b50fac7542476aef222ab5f1d49d86e38cba1) should be DOGTAG_10_5_9_RHEL_BRANCH Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:0168 |