Security: user can see password for services of admin

Bug #1230505 reported by Timur Nurlygayanov
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Murano
Fix Released
Critical
Unassigned

Bug Description

*Step To Reproduce*

1. Get valid X-Auth-Token with admin rules
2. Via REST API: Create environment, create session, create any service, deploy session
3. Get valid X-Auth-Token with user rules
4. Get deployments info (http://ip:8082/environments/env_id/deployments)

*Observed result*
In response user can find password for services of admin:
{code}{u'deployments': [{u'updated':....., u'services': [u'adminPassword': u'P@ssw0rd', u'credentials': {u'username': u'Administrator', u'password': u'P@ssw0rd', .....}, ....}]}{code}

Changed in murano:
importance: Undecided → Critical
status: New → Fix Committed
summary: - Security: user can see password for services of admin
+ Launchpad Bug #1230505: Security: user can see password for services of
+ admin
Changed in murano:
status: Fix Committed → Fix Released
summary: - Launchpad Bug #1230505: Security: user can see password for services of
- admin
+ Security: user can see password for services of admin
Changed in murano:
milestone: none → 0.2.1
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.