python-keystoneclient

  1. Bug #938315
  2. Comment #15

Comment 15 for bug 938315

Revision history for this message
Jeremy Stanley (fungi) wrote : Re: Updating password via keystoneclient CLI should be done securely.

Proposed impact description...

    Title: Keystone client local information disclosure
    Reporter: Jake Dahn (Nebula)
    Products: python-keystoneclient
    Affects: All versions

    Description:
    Jake Dahn from Nebula reported a vulnerability that the keystone
    client only allows passwords to be updated in a clear text
    command-line argument, which may enable other local users to obtain
    sensitive information by listing the process and potentially leaves
    a record of the password within the shell command history.