Project

General

Profile

Actions
Copy link

Bug #29519

open

exotic passwords fails vulnerability management

Bug #29519: exotic passwords fails vulnerability management

Added by Nicolas CHARLES 26 days ago. Updated 8 days ago.

Status:
Pending release
Priority:
0 (blocking)
Assignee:
Vincent MEMBRÉ
Category:
-
Target version:
9.0.10
Pull Request:
https://github.com/Normation/rudder/p...
Severity:
UX impact:
User visibility:
Effort required:
Priority:
0
Name check:
To do
Fix check:
To do
Regression:
No

Description

I'm using this password for my license

aA$C/[dsf!$q]\//$ŝfh[[é~}${a}2

I can download plugins and all, but vulnerrability management fails

2026-08-13 14:34:06+0200 INFO  plugin.cve.check - Making CVE check query for Suse 15 (kernel 6.4.0-15070
0.51-default) for 1 nodes
2026-08-13 14:34:08+0200 WARN  plugin.cve.check - An error occurred during cve check for
 1 Node(s), cve check still continue, details: Unexpected: Request failure URL 'https://api.rudder.io/cve/v2/vuls': code Some(401), body: Some(<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html><head>
<title>401 Unauthorized</title>
</head><body>
<h1>Unauthorized</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>
</body></html>
)

the password was set directly in the rudder-pkg.conf file, rudder package does work and package install from rudder does work

Setting the password from the web UI does not solve the issue

Subtasks 2 (2 open — 0 closed)

Bug #29657: Correct password reading in plugin privatePending releaseVincent MEMBRÉActions
Bug #29658: Correct password escaping in post-instPending releaseAlexis MoussetActions

Updated by Nicolas CHARLES 26 days ago Actions
Copy link
 #1

  • Description updated (diff)

Updated by Nicolas CHARLES 26 days ago Actions
Copy link
 #2

  • Description updated (diff)

Updated by Nicolas CHARLES 26 days ago Actions
Copy link
 #3

Changing the password to easy123!YEAH solves the issue

Updated by Nicolas CHARLES 26 days ago · Edited Actions
Copy link
 #4

password 

aA/[dsf!$q]$fh[[é~}2
fails
password 
aA/[dsf!q]fh[[~}2
works
password 
aA[dsf!qfh[[2
works

Updated by Nicolas CHARLES 25 days ago Actions
Copy link
 #5

these passwords fails

aA/[dsf!$q]$fh[[é~}2 
aA/[dsf!q]fh[[é~}2 
aA/[dsf!q]fh[[é~2 

aA[dsf!q]fh[[é~2

this is working

aA[dsf!q]fh[[~2

Updated by François ARMAND 12 days ago Actions
Copy link
 #7

  • Assignee set to François ARMAND

Updated by François ARMAND 12 days ago Actions
Copy link
 #8

It might be an encoding problem, since it looks like the faulty passwords contain é

Updated by François ARMAND 12 days ago Actions
Copy link
 #9

  • Status changed from New to In progress

Updated by François ARMAND 12 days ago Actions
Copy link
 #10

We are using the old Properties class in place of `Config`, so not utf-8.

Updated by François ARMAND 11 days ago Actions
Copy link
 #11

  • Subtask #29657 added

Updated by François ARMAND 11 days ago Actions
Copy link
 #12

  • Subtask #29658 added

Updated by François ARMAND 11 days ago Actions
Copy link
 #13

  • Project changed from 82 to Rudder
  • Target version changed from 9.0 to 9.0.10

Updated by François ARMAND 11 days ago Actions
Copy link
 #14

  • Status changed from In progress to Pending technical review
  • Assignee changed from François ARMAND to Vincent MEMBRÉ
  • Pull Request set to https://github.com/Normation/rudder/pull/7448

Updated by Anonymous 8 days ago Actions
Copy link
 #15

  • Status changed from Pending technical review to Pending release
Actions
Copy link

Also available in: PDF Atom