[Openstack-security] [openstack/python-keystoneclient] SecurityImpact review request change If5b196a734e7a0f0b3fa892d5c0436812a5bbd85
gerrit2 at review.openstack.org
gerrit2 at review.openstack.org
Thu Jun 12 04:31:39 UTC 2014
Hi, I'd like you to take a look at this patch for potential
SecurityImpact.
https://review.openstack.org/99432
Log:
commit 74b39df685229957c86c98c3d595bfebb95bcea5
Author: Morgan Fainberg <morgan.fainberg at gmail.com>
Date: Wed Jun 11 10:13:32 2014 -0700
Do not expose Token IDs in debug output
It is only very slightly less of a security issue to expose
Token IDs in the logs than it is to expose password details. This
change obscures the Token ID in the debug output in all cases to
ensure that the ID is not presented in any of the logs that could
be read by a unpriviledged source (e.g. lower priv log watchers,
centralized logging, etc).
The raw data elements from the token (e.g. user, roles, expiration
etc) could be added into debug/trace level logging at a future time.
SecurityImpact
Change-Id: If5b196a734e7a0f0b3fa892d5c0436812a5bbd85
More information about the Openstack-security
mailing list