[Openstack-security] [Bug 1708547] Re: Infortrend driver logs password in commands

OpenStack Infra 1708547 at bugs.launchpad.net
Thu Aug 3 23:08:30 UTC 2017


Fix proposed to branch: master
Review: https://review.openstack.org/490674

** Changed in: cinder
       Status: New => In Progress

** Changed in: cinder
     Assignee: (unassigned) => Walt Boring (walter-boring)

-- 
You received this bug notification because you are a member of OpenStack
Security, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1708547

Title:
  Infortrend driver logs password in commands

Status in Cinder:
  In Progress

Bug description:
  The Infortrend driver's cli_factory constructs a command to execute,
  which can include a password.  When the command fails, the cli_factory
  logs the entire command line to the log file, leaving the password in
  clear text.

  password line
  https://github.com/openstack/cinder/blob/master/cinder/volume/drivers/infortrend/raidcmd_cli/cli_factory.py#L173-L175

  command logged 
  https://github.com/openstack/cinder/blob/master/cinder/volume/drivers/infortrend/raidcmd_cli/cli_factory.py#L221-L226

To manage notifications about this bug go to:
https://bugs.launchpad.net/cinder/+bug/1708547/+subscriptions




More information about the Openstack-security mailing list