Project

General

Profile

Bug #28112

Bug #29931: Root repository upstream password saved in clear text

yum repos password stored as cleartext in audits

Added by Kavita Gaikwad almost 2 years ago. Updated about 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Category:
Repositories
Target version:
-
Difficulty:
Triaged:
Yes
Bugzilla link:
Fixed in Releases:
Found in Releases:

Description

Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=1630536

Description of problem:

When you set a password for a repo in "Upstream Password" field, it appears in cleartext in the audit logs.

Due to:

Bug 1630535 - admin password is added to yum repo config

the admin password can end up in the audit logs.

Version-Release number of selected component (if applicable):

~]# rpm -q satellite
satellite-6.4.0-14.el7sat.noarch

How reproducible:

Steps to Reproduce:
1. Products > Repositories
2. Create a custom product with a yum repository.
3. Add a password to "Upstream Password"
4. Check the audit logs

Actual results:

Admin (10.40.205.48) updated Katello/Repository: Test BZ1625264

Upstream password changed from [empty] to changeme
Checksum type changed from sha256 to sha1

Expected results:

Admin (10.40.205.48) updated Katello/Repository: Test BZ1625264

Upstream password changed from [empty] to [redacted]
Checksum type changed from sha256 to sha1

History

#1 Updated by James Jeffers almost 2 years ago

  • Triaged changed from No to Yes
  • Target version set to Katello Backlog

#2 Updated by The Foreman Bot over 1 year ago

  • Target version deleted (Katello Backlog)
  • Status changed from New to Ready For Testing
  • Pull request https://github.com/Katello/katello/pull/8726 added

#3 Updated by Justin Sherrill over 1 year ago

  • Subject changed from yum repos password stored as cleartext to yum repos password stored as cleartext in audits

#4 Updated by Bryan Kearney about 1 year ago

  • Parent task set to #29931
  • Status changed from Ready For Testing to Duplicate

#5 Updated by Bryan Kearney about 1 year ago

  • Status changed from Duplicate to Closed

Dupe of 29931

Also available in: Atom PDF