Bug 1730668 - CVE-2019-14825 katello: Registry credentials are captured in plain text in dynflow task during repository discovery [rhn_satellite_6-default]
Summary: CVE-2019-14825 katello: Registry credentials are captured in plain text in dy...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Repositories
Version: 6.5.0
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: 6.6.0
Assignee: Justin Sherrill
QA Contact: vijsingh
URL:
Whiteboard:
: 1748729 (view as bug list)
Depends On:
Blocks: CVE-2019-14825
TreeView+ depends on / blocked
 
Reported: 2019-07-17 10:12 UTC by hprakash
Modified: 2019-10-22 12:48 UTC (History)
3 users (show)

Fixed In Version: tfm-rubygem-katello-3.12.0.9-1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-10-22 12:47:55 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
Screenshot (71.58 KB, image/png)
2019-08-19 06:57 UTC, vijsingh 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 27485 0 Normal Closed CVE-2019-14825: Registry credentials are captured in plain text in dynflow task during repository discovery 2021-01-13 07:40:06 UTC
Red Hat Product Errata RHSA-2019:3172 0 None None None 2019-10-22 12:48:10 UTC

Comment 3 Justin Sherrill 2019-07-31 15:14:58 UTC 
Created redmine issue https://projects.theforeman.org/issues/27485 from this bug
Comment 4 Bryan Kearney 2019-07-31 16:04:17 UTC 
Upstream bug assigned to jsherril
Comment 5 Bryan Kearney 2019-07-31 16:04:18 UTC 
Upstream bug assigned to jsherril
Comment 6 Bryan Kearney 2019-08-01 16:04:11 UTC 
Moving this bug to POST for triage into Satellite 6 since the upstream issue https://projects.theforeman.org/issues/27485 has been resolved.
Comment 8 vijsingh 2019-08-19 06:56:45 UTC 
ON_QA Verified:

@Satellite 6.6.0 snap 16.0

Steps/Observations:

 1. Logged in to Satellite WebUI
 2. Content> Products> Repo Discovery
 3. Selected 'Container Images' for 'Repository Type'
 4. Selected 'Red Hat registry'
 5. Entered registry username and password
 6. click on 'Discover'
 7. Checked the relevant task on the tasks page and verify the dynflow console, 
    the action Actions::Katello::Repository::Discover shows the input parameters 
    which contains upstream_password in encrypted way.


Attached screenshot.
Comment 9 vijsingh 2019-08-19 06:57:39 UTC 
Created attachment 1605653 [details]
Screenshot
Comment 10 Doran Moppert 2019-09-04 03:51:00 UTC 
*** Bug 1748729 has been marked as a duplicate of this bug. ***
Comment 13 errata-xmlrpc 2019-10-22 12:47:55 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:3172
Note You need to log in before you can comment on or make changes to this bug.