[Openstack-security] [Bug 1247217] Fix merged to nova (master)
OpenStack Infra
1247217 at bugs.launchpad.net
Thu Dec 5 21:05:56 UTC 2013
Reviewed: https://review.openstack.org/56069
Committed: http://github.com/openstack/nova/commit/187140c2fcafb56752f0160832607e374a4a94ff
Submitter: Jenkins
Branch: master
commit 187140c2fcafb56752f0160832607e374a4a94ff
Author: Lance Bragstad <ldbragst at us.ibm.com>
Date: Thu Nov 14 15:44:15 2013 +0000
Use password masking utility provided in Oslo
Implement the mask_password function provided in Oslo-incubator's
log.py. Instead of having a specific version in Nova different from
other projects that are essentially doing the same thing.
Change-Id: I7e04b7d31d4d6959b17b1da9654553042eec70f1
Closes-Bug: #1247217
--
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1247217
Title:
Sanitize passwords when logging payload in wsgi for API Extensions
Status in OpenStack Compute (Nova):
Fix Committed
Status in Oslo - a Library of Common OpenStack Code:
In Progress
Bug description:
The fix for bug 1231263 ( https://bugs.launchpad.net/nova/+bug/1231263
) addressed not logging the clear-text password in the nova wsgi.py
module for the adminPass attribute for the Server Change Password REST
API, but this only addressed that specific attribute. Since Nova has
support for the ability to add REST API Extensions (in the contrib
directory), there could any number of other password-related
attributes in the request/response body for those additional
extensions.
Although it would not be possible to know all of the various sensitive
attributes that these API's would pass in the request/response (the
only way to totally eliminate the exposure would be to not log the
request/response which is useful for debugging), I would like to
propose a change similar to the one that was made in keystone (under
https://bugs.launchpad.net/keystone/+bug/1166697) to mask the password
in the log statement for any attribute that contains the "password"
sub-string in it.
The change would in essence be to update the _SANITIZE_KEYS /
_SANITIZE_PATTERNS lists in the nova/api/openstack/wsgi.py module to
include a pattern for the "password" sub-string.
Also, for a slight performance benefit, it may be useful to put a
check in to see if debug logging level is enabled around the debug
statement that does the sanitize call (since the request/response
bodies could be fairly large and wouldn't want to take the hit to do
the pattern matches if debug isn't on).
To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1247217/+subscriptions
More information about the Openstack-security
mailing list