[ https://issues.apache.org/jira/browse/KARAF-7256?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jean-Baptiste Onofré updated KARAF-7256: ---------------------------------------- Target Version/s: 4.4.5, 4.3.11 (was: 4.4.4, 4.3.10) > Action logs could leak passwords if passed as argument or option > ---------------------------------------------------------------- > > Key: KARAF-7256 > URL: https://issues.apache.org/jira/browse/KARAF-7256 > Project: Karaf > Issue Type: Bug > Components: karaf > Affects Versions: 4.3.2 > Reporter: J. Brébec > Assignee: Jean-Baptiste Onofré > Priority: Major > > If a shell Action take a sensible argument like a password, this password > will be visible every time the Action log something. > The statement is used to set the name of the thread, without obfuscating any > arguments or options. The thread name is logged with the default log4j > configuration. > [felix-dev/Pipe.java at 3e5671ae7e5107f4f849ef9d5f0a89b1ba9d7439 · > apache/felix-dev · > GitHub|https://github.com/apache/felix-dev/blob/3e5671ae7e5107f4f849ef9d5f0a89b1ba9d7439/gogo/runtime/src/main/java/org/apache/felix/gogo/runtime/Pipe.java#L228] > > Using the "censor" property in @Argument or @Option doesn't change anything. -- This message was sent by Atlassian Jira (v8.20.10#820010)