Ubuntu
apport package

  1. Bug #1738581
  2. Comment #0

Comment 0 for bug 1738581

Revision history for this message
H.-Dirk Schmitt (dirk-computer42) wrote : apport leaks environment variables (including passwords!) to bug reports

See the bug report https://bugs.launchpad.net/ubuntu/+source/evolution/+bug/1738564
created with ubuntu-bug.

Apport includes the file JournalErrors.txt
This file includes e.g. the following line.
Dez 16 19:11:31 hostname /usr/lib/gdm3/gdm-x-session[9679]: dbus-update-activation-environment: setting <email address hidden>

Normally it would be not problem that gdm-x-session write this to the journal, because the journal is not intended to be published on the internet.

Setting confidential informations via environment is maybe not the best idea, but a legal procedure and for `mpc` the only way to set this information.

IMHO the apport utility is here the problem, because it includes the file with risky information to a public visible bug report.

Note: I manually delete the attachment in the mentioned bug report. But how can I sure that a web crawlser hasn't read/preserved that attachment?