Bohdan Siryk created CASSANDRA-21686:
----------------------------------------
Summary: Leaked raw password_hash in system_views.settings
Key: CASSANDRA-21686
URL: https://issues.apache.org/jira/browse/CASSANDRA-21686
Project: Apache Cassandra
Issue Type: Bug
Reporter: Bohdan Siryk
CASSANDRA-21546 introduced a pluggable default role initializer, and its
parameters are visible in {*}system_views.settings{*}. Settings with
_{_}password{_} are redacted, but with _hash_ (e.g. \{_}password{_}_hash)
suffix are visible.
{code:java}
cqlsh> SELECT * FROM system_views.settings WHERE name LIKE
'%default_role_initializer%'; name | value
-------------------------------------+------------------------------------------------------------------------------------------------------
default_role_initializer.class_name |
PasswordDefaultRoleInitializer
default_role_initializer.parameters |
{"role":"cassandra1","password_hash":"$2a$04$wsvzFamDJPDrTwMjgfcgpO.mKc.CMEuHBFZSjhGz2Ts6.v8PUO2rC"}
{code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
