yahoo-eng-team team mailing list archive

[Anna Sortland <annasort@xxxxxxxxxx>]

Public bug reported:

neutronclient logs sensitive info in headers when logging http requests
in debug mode.

/usr/lib/python2.7/site-
packages/neutronclient/common/utils.py:http_log_req()

neutronclient should hash sensitive info in headers such as 'X-Auth-Token' and 'X-Subject-Token'.
For examples, see keystoneclient (https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/openstack/common/apiclient/client.py#L105), glanceclient, or ceilometerclient.

** Affects: neutron
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1516691

Title:
  neutronclient logs sensitive info in http requests

Status in neutron:
  New

Bug description:
  neutronclient logs sensitive info in headers when logging http
  requests in debug mode.

  /usr/lib/python2.7/site-
  packages/neutronclient/common/utils.py:http_log_req()

  neutronclient should hash sensitive info in headers such as 'X-Auth-Token' and 'X-Subject-Token'.
  For examples, see keystoneclient (https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/openstack/common/apiclient/client.py#L105), glanceclient, or ceilometerclient.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1516691/+subscriptions