[Openstack-security] [Bug 1708547] Fix included in openstack/cinder 11.0.0.0rc1

OpenStack Infra 1708547 at bugs.launchpad.net
Fri Aug 11 02:51:50 UTC 2017


This issue was fixed in the openstack/cinder 11.0.0.0rc1 release
candidate.

-- 
You received this bug notification because you are a member of OpenStack
Security, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1708547

Title:
  Infortrend driver logs password in commands

Status in Cinder:
  Fix Released

Bug description:
  The Infortrend driver's cli_factory constructs a command to execute,
  which can include a password.  When the command fails, the cli_factory
  logs the entire command line to the log file, leaving the password in
  clear text.

  password line
  https://github.com/openstack/cinder/blob/master/cinder/volume/drivers/infortrend/raidcmd_cli/cli_factory.py#L173-L175

  command logged 
  https://github.com/openstack/cinder/blob/master/cinder/volume/drivers/infortrend/raidcmd_cli/cli_factory.py#L221-L226

To manage notifications about this bug go to:
https://bugs.launchpad.net/cinder/+bug/1708547/+subscriptions




More information about the Openstack-security mailing list