Project

General

Profile

Actions
Copy link

Bug #29658

open

Bug #29519: exotic passwords fails vulnerability management

Correct password escaping in post-inst

Bug #29658: Correct password escaping in post-inst

Added by François ARMAND 12 days ago. Updated 11 days ago.

Status:
Pending release
Priority:
N/A
Assignee:
Alexis Mousset
Category:
-
Target version:
9.2.0~beta2
Pull Request:
https://github.com/Normation/rudder-p...
Severity:
UX impact:
User visibility:
Effort required:
Priority:
0
Name check:
To do
Fix check:
To do
Regression:
No

Description

See parent. We have the same kind of problem in other escape: we use sed to escape pg pass and escape "\". In the general case, that doesn't pause any problem since we generate an hexa pass, but it could be one in an external db usage.
The problem is that we write that pass in 3 files with different escaping rules:
- rudder-web.properties: java properties rules,
- rudder-passwords.conf: KEY:value with no escaping,
- .pgpass escapes `\` and the `:` field separator.

Updated by François ARMAND 11 days ago Actions
Copy link
 #1

  • Description updated (diff)

Updated by François ARMAND 11 days ago Actions
Copy link
 #2

  • Status changed from New to In progress

Updated by François ARMAND 11 days ago Actions
Copy link
 #3

  • Status changed from In progress to Pending technical review
  • Assignee changed from François ARMAND to Alexis Mousset
  • Pull Request set to https://github.com/Normation/rudder-packages/pull/3190

Updated by François ARMAND 11 days ago Actions
Copy link
 #4

  • Target version changed from 9.0.10 to 9.2.0~beta2

Given the rarity of that config, we only target 9.2

Updated by Anonymous 11 days ago Actions
Copy link
 #5

  • Status changed from Pending technical review to Pending release
Actions
Copy link

Also available in: PDF Atom