Project

General

Profile

Actions

Bug #38185

open

Password from HTTP(S) proxy Setting is logged in plaintext to production.log

Added by Lucy Fu 3 days ago. Updated about 3 hours ago.

Status:
Ready For Testing
Priority:
Normal
Assignee:
Category:
Settings
Target version:
-
Difficulty:
Triaged:
No
Fixed in Releases:
Found in Releases:

Description

Description of problem:
When specifying credentials in HTTP Proxy in Satellite Settings, the password can be logged in plaintext into `production.log`. While the logfile is accessible by `root` and `foreman` users only, it is still a door to a security problem (currently, sosreport collects the file without redacting the password; I will fix that).

It is worth obfuscating the password directly in the logfile.

How reproducible:
100%

Is this issue a regression from an earlier version:
Probably not.

Steps to Reproduce:

1. WebUI -> Settings -> HTTP Proxy -> put there e.g. `https://USER:SECRETPASSWORD@squid-server:3128` (where `squid-server` is an address of your proxy)

2. Update the value anyhow (to see other log entry with password)

3. open WebUI -> Content -> Subscriptions (or any other page that triggers an outgoing request)

Actual behavior:
1. and 2. and 3. subsequently trigger logs:

2024-12-12T15:27:03 [I|aud|68392978] Setting (7) create event on value --- https://USER:SECRETPASSWORD@localhost:443
2024-12-12T16:15:59 [I|aud|e44a4430] Setting (7) update event on value --- https://USER:SECRETPASSWORD@localhost:443, --- https://USER:SECRETPASSWORD@pmoravec-rhel9:3128
2024-12-12T16:16:21 [I|app|d6afc88a] (RestClient) Proxying request to subscription.rhsm.redhat.com via https://USER:SECRETPASSWORD@pmoravec-rhel9:3128
Expected behavior:
No password present in the logfile.

Business Impact / Additional info:

The customer also sees logs like:

8d25bf63 | ..., --- http://USER:PASSWORD@1.2.3.4:8080
that I am unable to reproduce. Anyway I assume the fix will be generic enough to ensure any logging of the proxy URL will have credentials obfuscated.

Actions

Also available in: Atom PDF