OpenStack shell print credentials by default in debug mode

[Xu Han Peng]

OpenStack shell client prints credential information (user password and user token) by default in debug mode.

For example:

neutron --debug net-list
DEBUG: neutronclient.neutron.v2_0.network.ListNetwork get_data(Namespace(columns=[], fields=[], formatter='table', page_size=None, quote_mode='nonnumeric', request_format='json', show_details=False, sort_dir=[], sort_key=[]))
DEBUG: neutronclient.client
REQ: curl -i http://10.9.0.51:5000/v2.0/tokens -X POST -H "Content-Type: application/json" -H "Accept: application/json" -H "User-Agent: python-neutronclient" -d '{"auth": {"tenantName": "service", "passwordCredentials": {"username": "admin", "password": "openstack1"}}}'

Other components also has the credentials in debug mode.

This behavior exposes a vulnerability to print sensitive information by shell when user didn't expect so.

[Tristan Cacqueray (tristan-cacqueray)]

Hello,

thanks for the report, the OSSA task is set to Won't Fix because password leak in debug mode does not warrant an advisory.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/104497

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/106932

[Qin Zhao (zhaoqin)]

Code change for Nova client is proposed https://review.openstack.org/#/c/106987/

[gordon chung (chungg)]

should this be done in oslo client code? so we don't have x different solutions running around?

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/106932
Committed: https://git.openstack.org/cgit/openstack/python-ceilometerclient/commit/?id=e5048043e211ea9cc094e439a51099fdc7e38e2e
Submitter: Jenkins
Branch: master

commit e5048043e211ea9cc094e439a51099fdc7e38e2e
Author: Zhi Kun Liu <email address hidden>
Date: Tue Jul 15 13:17:05 2014 +0800

    Don't expose X-Auth-Token in ceilometer CLI

    Ceilometer CLI exposes X-Auth-Token in debug mode. This patch
    replaces X-Auth-Token's value with '{SHA1}<sha1oftoken>'. Some
    credentials are exposed by keystoneclient as ceilometerclient
    uses keystoneclient to authenticate, it will be fixed in bug:
    100414.

    Change-Id: Ia6364314e4b4d26301f974582c0c2ba34b054c86
    Partial-Bug: #1327019

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/109234

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/109239

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/109808

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/106987
Committed: https://git.openstack.org/cgit/openstack/python-novaclient/commit/?id=60d1283968643064351f182483b0df0ac93f6640
Submitter: Jenkins
Branch: master

commit 60d1283968643064351f182483b0df0ac93f6640
Author: Qin Zhao <email address hidden>
Date: Tue Jul 15 18:25:57 2014 +0800

    Don't log sensitive auth data

    This code change redacts the password in keystone request, and
    also redact the token text in keystone response. The code still
    makes REST call by itelf, instead of calling keystone client.

    Closes-Bug: 1327019

    Change-Id: Ib9c0610c1ef351a127364478721cf961c2a30125

[OpenStack Infra (hudson-openstack)]

Change abandoned by Huang Zhiteng (<email address hidden>) on branch: master
Review: https://review.openstack.org/109808

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/109234
Committed: https://git.openstack.org/cgit/openstack/python-heatclient/commit/?id=99fabf0dceb04517c88b45609d1d0a1ff829f892
Submitter: Jenkins
Branch: master

commit 99fabf0dceb04517c88b45609d1d0a1ff829f892
Author: lvdongbing <email address hidden>
Date: Thu Jul 24 17:49:32 2014 +0800

    Don't expose X-Auth-Token in heat CLI

    Heat CLI exposes X-Auth-Token in debug mode. This patch replaces
    X-Auth-Token's value with '{SHA1}<sha1oftoken>'. Some credentials
    are exposed by keystoneclient as heatclient uses keystoneclient to
    authenticate, it will be fixed in bug:100414.

    Change-Id: Ic768af5a947535807ba449fb0aeb1eb98dac56e6
    Partial-Bug: #1327019

[OpenStack Infra (hudson-openstack)]

Change abandoned by Flavio Percoco (<email address hidden>) on branch: master
Review: https://review.openstack.org/109239
Reason: Superseded Change-Id: I3045d6d9d2a13770f4022dbbd474b34eb1032f6e

[OpenStack Infra (hudson-openstack)]

Change abandoned by Kyle Mestery (<email address hidden>) on branch: master
Review: https://review.openstack.org/104497
Reason: This change is old enough and hasn't seen any updates since July 10, 2014. Abandoning it, please revive it if you plan to work on it again.

[Armando Migliaccio (armando-migliaccio)]

This bug is > 172 days without activity. We are unsetting assignee and milestone and setting status to Incomplete in order to allow its expiry in 60 days.

If the bug is still valid, then update the bug status.

[Sean McGinnis (sean-mcginnis)]

Unable to reproduce with the current cinderclient.

[Akihiro Motoki (amotoki)]

neutron CLI now uses keystoneauth and keystoneauth handles it.

There might be the issue in past releases but there is no issue in the current supported releases (mitaka and later)

[Cyril Roelandt (cyril-roelandt)]

This was fixed in glanceclient with https://review.opendev.org/c/openstack/python-glanceclient/+/121692 .