yahoo-eng-team team mailing list archive

Thread
Date

[Bug 920687] Re: Instance root-password is logged in plain-text

To: yahoo-eng-team@xxxxxxxxxxxxxxxxxxx
From: Sean Dague <sean@xxxxxxxxx>
Date: Mon, 15 Sep 2014 15:39:11 -0000
Reply-to: Bug 920687 <920687@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

** Changed in: nova/diablo
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/920687

Title:
  Instance root-password is logged in plain-text

Status in OpenStack Compute (Nova):
  Fix Released
Status in OpenStack Compute (nova) diablo series:
  Fix Released

Bug description:
  nova.rpc is logging the dict that is passed to the compute worker
  which contains the key `new_pass` that has the instance-root-password
  (if it's a set_admin_password operation).

  The proposed fix is to sanitize the dictionary before logging and
  replacing the value with something like '<PASSWORD>'.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/920687/+subscriptions