salt: CVE-2015-6918: git module leaks authentication details into log

Debian Bug report logs - #803182
salt: CVE-2015-6918: git module leaks authentication details into log

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: salt: CVE-2015-6918: git module leaks authentication details into log

Date: Tue, 27 Oct 2015 19:37:41 +0100

Source: salt
Version: 2014.1.13+ds-1
Severity: important
Tags: security upstream

Hi,

the following vulnerability was published for salt.

CVE-2015-6918[0]:
git module leaks authentication details into log

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2015-6918
[1] https://github.com/saltstack/salt/commit/28aa9b105804ff433d8f663b2f9b804f2b75495a

Regards,
Salvatore

Message #10 received at 803182-done@bugs.debian.org (full text, mbox, reply):

From: Benjamin Drung <benjamin.drung@profitbricks.com>

To: 803182-done@bugs.debian.org

Subject: salt: CVE-2015-6918: git module leaks authentication details into log

Date: Wed, 09 Dec 2015 13:45:21 +0100

Version: 2015.8.1+ds-1

The security bug was fixed upstream in release 2015.5.5 and thus the
fix was part of the next Debian upload 2015.8.1+ds-1

-- 
Benjamin Drung
System Developer
Debian & Ubuntu Developer

ProfitBricks GmbH
Greifswalder Str. 207
D - 10405 Berlin

Email: benjamin.drung@profitbricks.com
URL:  http://www.profitbricks.com

Sitz der Gesellschaft: Berlin.
Registergericht: Amtsgericht Charlottenburg, HRB 125506B.
Geschäftsführer: Andreas Gauger, Achim Weiss.

Message #15 received at 803182@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 803182@bugs.debian.org

Subject: Re: Bug#803182 closed by Benjamin Drung <benjamin.drung@profitbricks.com> (salt: CVE-2015-6918: git module leaks authentication details into log)

Date: Wed, 9 Dec 2015 22:15:00 +0100

Control: found -1 2015.8.1+ds-1
Control: fixed -1 2015.8.3+ds-1

> Version: 2015.8.1+ds-1
> 
> The security bug was fixed upstream in release 2015.5.5 and thus the
> fix was part of the next Debian upload 2015.8.1+ds-1

Checking the debdiffs it looks the fix was actually only in
2015.8.3+ds-1 but not in 2015.8.1+ds-1. Adjusting thus the fixed
version.

Regards,
Salvatore

Message #28 received at 803182-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 803182-submitter@bugs.debian.org

Subject: closing 803182

Date: Wed, 09 Dec 2015 22:20:26 +0100

close 803182 2015.8.3+ds-1
thanks

Message #33 received at 803182@bugs.debian.org (full text, mbox, reply):

From: Benjamin Drung <benjamin.drung@profitbricks.com>

To: Salvatore Bonaccorso <carnil@debian.org>, 803182@bugs.debian.org

Subject: Re: [Pkg-salt-team] Bug#803182: closed by Benjamin Drung <benjamin.drung@profitbricks.com> (salt: CVE-2015-6918: git module leaks authentication details into log)

Date: Thu, 10 Dec 2015 12:37:06 +0100

Am Mittwoch, den 09.12.2015, 22:15 +0100 schrieb Salvatore Bonaccorso:
> Control: found -1 2015.8.1+ds-1
> Control: fixed -1 2015.8.3+ds-1
> 
> > Version: 2015.8.1+ds-1
> > 
> > The security bug was fixed upstream in release 2015.5.5 and thus
> > the
> > fix was part of the next Debian upload 2015.8.1+ds-1
> 
> Checking the debdiffs it looks the fix was actually only in
> 2015.8.3+ds-1 but not in 2015.8.1+ds-1. Adjusting thus the fixed
> version.

Really? 2015.8.1+ds-1 already uses redact_http_basic_auth() in
_git_run() for stderr:

                msg = 'Command \'{0}\' failed'.format(
                    salt.utils.url.redact_http_basic_auth(gitcommand)
                )
                if result['stderr']:
                    msg += ': {0}'.format(
                       
 salt.utils.url.redact_http_basic_auth(result['stderr'])
                    )
                raise CommandExecutionError(msg)

-- 
Benjamin Drung
System Developer
Debian & Ubuntu Developer

ProfitBricks GmbH
Greifswalder Str. 207
D - 10405 Berlin

Email: benjamin.drung@profitbricks.com
URL:  http://www.profitbricks.com

Sitz der Gesellschaft: Berlin.
Registergericht: Amtsgericht Charlottenburg, HRB 125506B.
Geschäftsführer: Andreas Gauger, Achim Weiss.

Message #38 received at 803182@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Benjamin Drung <benjamin.drung@profitbricks.com>

Cc: 803182@bugs.debian.org

Subject: Re: [Pkg-salt-team] Bug#803182: closed by Benjamin Drung <benjamin.drung@profitbricks.com> (salt: CVE-2015-6918: git module leaks authentication details into log)

Date: Thu, 10 Dec 2015 20:41:41 +0100

Hi Benjamin,

On Thu, Dec 10, 2015 at 12:37:06PM +0100, Benjamin Drung wrote:
> Am Mittwoch, den 09.12.2015, 22:15 +0100 schrieb Salvatore Bonaccorso:
> > Control: found -1 2015.8.1+ds-1
> > Control: fixed -1 2015.8.3+ds-1
> > 
> > > Version: 2015.8.1+ds-1
> > > 
> > > The security bug was fixed upstream in release 2015.5.5 and thus
> > > the
> > > fix was part of the next Debian upload 2015.8.1+ds-1
> > 
> > Checking the debdiffs it looks the fix was actually only in
> > 2015.8.3+ds-1 but not in 2015.8.1+ds-1. Adjusting thus the fixed
> > version.
> 
> Really? 2015.8.1+ds-1 already uses redact_http_basic_auth() in
> _git_run() for stderr:
> 
>                 msg = 'Command \'{0}\' failed'.format(
>                     salt.utils.url.redact_http_basic_auth(gitcommand)
>                 )
>                 if result['stderr']:
>                     msg += ': {0}'.format(
>                        
>  salt.utils.url.redact_http_basic_auth(result['stderr'])
>                     )
>                 raise CommandExecutionError(msg)

Hmm, I will reckeck then, sorry for the noise. What I did was to check
the debdiff between 2015.8.1+ds-1 and 2015.8.3+ds-1 and looked that
the relevant commit was only included there.

Can recheck, in any case thanks for the new upstream version which
fixes as well another CVE!

Regards,
Salvatore

Message #43 received at 803182@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 803182@bugs.debian.org

Cc: Benjamin Drung <benjamin.drung@profitbricks.com>

Subject: Re: Bug#803182: [Pkg-salt-team] Bug#803182: closed by Benjamin Drung <benjamin.drung@profitbricks.com> (salt: CVE-2015-6918: git module leaks authentication details into log)

Date: Thu, 10 Dec 2015 21:09:33 +0100

Control: fixed -1 2015.8.1+ds-1

Hey Benjamin,

On Thu, Dec 10, 2015 at 08:41:41PM +0100, Salvatore Bonaccorso wrote:
> Hi Benjamin,
> 
> On Thu, Dec 10, 2015 at 12:37:06PM +0100, Benjamin Drung wrote:
> > Am Mittwoch, den 09.12.2015, 22:15 +0100 schrieb Salvatore Bonaccorso:
> > > Control: found -1 2015.8.1+ds-1
> > > Control: fixed -1 2015.8.3+ds-1
> > > 
> > > > Version: 2015.8.1+ds-1
> > > > 
> > > > The security bug was fixed upstream in release 2015.5.5 and thus
> > > > the
> > > > fix was part of the next Debian upload 2015.8.1+ds-1
> > > 
> > > Checking the debdiffs it looks the fix was actually only in
> > > 2015.8.3+ds-1 but not in 2015.8.1+ds-1. Adjusting thus the fixed
> > > version.
> > 
> > Really? 2015.8.1+ds-1 already uses redact_http_basic_auth() in
> > _git_run() for stderr:
> > 
> >                 msg = 'Command \'{0}\' failed'.format(
> >                     salt.utils.url.redact_http_basic_auth(gitcommand)
> >                 )
> >                 if result['stderr']:
> >                     msg += ': {0}'.format(
> >                        
> >  salt.utils.url.redact_http_basic_auth(result['stderr'])
> >                     )
> >                 raise CommandExecutionError(msg)
> 
> Hmm, I will reckeck then, sorry for the noise. What I did was to check
> the debdiff between 2015.8.1+ds-1 and 2015.8.3+ds-1 and looked that
> the relevant commit was only included there.
> 
> Can recheck, in any case thanks for the new upstream version which
> fixes as well another CVE!

You are right, apologies for my previous error in checking for the
fix.

Regards,
Salvatore

Send a report that this bug log contains spam.