bugmonotone - Bugs: bug #15771, Passphrase returned fom hook...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #15771: Passphrase returned fom hook should not be echoed on "--debug" output

Submitted by:  Nuno Lucas <nlucas>
Submitted on:  Thu 16 Feb 2006 04:16:12 PM UTC  
 
Category: error handlingSeverity: 3 - Normal
Item Group: incorrect behaviorStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed
mtn version --full: 

monotone 0.25 (base revision: 4f4cb0aa339ad70c5b2624db22073d9e9a36c115)
Running on: Linux 2.6.12-10-686 #1 Mon Jan 16 17:58:04 UTC 2006 i686
Changes since base revision:
new_manifest [76b5ea65324372db9886d2c0a8cee8e759841c8c]

old_revision [4f4cb0aa339ad70c5b2624db22073d9e9a36c115]
old_manifest [76b5ea65324372db9886d2c0a8cee8e759841c8c]

Generated from data cached in the distribution;
further changes may have been made.

Generated from data cached in the distribution;
further changes may have been made.

Generated from data cached in the distribution;
further changes may have been made.

Generated from data cached in the distribution;
further changes may have been made.

Generated from data cached in the distribution;
further changes may have been made.

Tue 25 Apr 2006 10:10:37 PM UTC, comment #1:

This is fixed in 9c0ec198a0e8bc78105e2ec8a2d6f3912ced9a10, on 2006-04-25.

Timothy Brownawell <tbrownaw>
Project Member
Thu 16 Feb 2006 04:16:12 PM UTC, original submission:

To run a monotone server with "--debug" enabled and redirected to a log file, one has to be sure that log file is not readable by the world, as the passphrase returned by the get_passphrase hook is also logged.

As an example (obviously with the passphrase changed), this excerpt:

[...]
monotone: loading lua hook get_passphrase
monotone: lua: extracted string = my_clear_text_pass_phrase
[...]

As there is no category/group for security issues, choose "incorrect behaviour", but it's more of a (maybe minor, depending on your paranoia level) security issue.

Nuno Lucas <nlucas>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 2 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Tue 25 Apr 2006 11:01:44 PM UTCnjsStatusNone=>Fixed
  Open/ClosedOpen=>Closed

Back to the top


Powered by Savane 3.1-cleanup1