Jira (PUP-9787) Unintentional secret reveal while installing modules

0 views
Skip to first unread message

Chris Suszynski (JIRA)

unread,
Jun 19, 2019, 6:46:04 PM6/19/19
to puppe...@googlegroups.com
Chris Suszynski created an issue
 
Puppet / Bug PUP-9787
Unintentional secret reveal while installing modules
Issue Type: Bug Bug
Affects Versions: PUP 4.10.0
Assignee: Unassigned
Components: Modules
Created: 2019/06/19 3:45 PM
Priority: Minor Minor
Reporter: Chris Suszynski

Puppet Version: any
Puppet Server Version: any
OS Name/Version: any

Actual Behavior:

Puppet Forge is public, and downloading modules don't require authentication. However there are some repositories that can hold modules and require authentication to connect.

Those repositories are:

When installing modules from those repositories user is forced to set his credentials in plain text in URI supported form, for ex.:

Installing modules with similar module repository being set, reveals those credentials. In fact it's done each time a module is installed, with a message:

Notice: Preparing to install into /home/jdoe/.puppetlabs/etc/code/modules ...
 
Notice: Downloading from https://jdoe:s3c...@pkg.acmecorp.com/repository/puppet ...

Desired Behavior:

Puppet should mask password if given, like this:

Notice: Preparing to install into /home/jdoe/.puppetlabs/etc/code/modules ...
 
Notice: Downloading from https://jdoe:***@pkg.acmecorp.com/repository/puppet ...

 
Add Comment Add Comment
 
This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)
Atlassian logo

Chris Suszynski (JIRA)

unread,
Jun 19, 2019, 6:47:04 PM6/19/19
to puppe...@googlegroups.com
Chris Suszynski updated an issue
Change By: Chris Suszynski
Acceptance Criteria: * Puppet should not reveal sensitive information while isntalling modules.
* Usit Unit tests are added that assure that marking masking is done

Chris Suszynski (JIRA)

unread,
Jun 19, 2019, 6:48:02 PM6/19/19
to puppe...@googlegroups.com
Chris Suszynski updated an issue
Change By: Chris Suszynski
Affects Version/s: PUP 4.10.0
Affects Version/s: PUP 4.10.12
Affects Version/s: PUP 5.5.14
Affects Version/s: PUP 6.4.2

Chris Suszynski (JIRA)

unread,
Jun 20, 2019, 4:30:03 AM6/20/19
to puppe...@googlegroups.com
Chris Suszynski updated an issue
*Puppet Version:* any
*Puppet Server Version:* any
*OS Name/Version:* any

*Actual Behavior:*


Puppet Forge is public, and downloading modules don't require authentication. However there are some repositories that can hold modules and require authentication to connect.

Those repositories are:


When installing modules from those repositories user is forced to set his credentials in plain text in URI supported form, for ex.:

 Installing modules with similar module repository being set, reveals those credentials. In fact it's done each time a module is installed, with a message:
{noformat}
Notice: Preparing to install into /home/jdoe/.puppetlabs/etc/code/modules ...
Notice: Downloading from https://jdoe:s3c...@pkg.acmecorp.com/repository/puppet ...
{noformat}
*Desired Behavior:*


Puppet should mask password if given, like this:

 {noformat}
Notice: Preparing to install into /home/jdoe/.puppetlabs/etc/code/modules ...
Notice: Downloading from https://jdoe:***@pkg.acmecorp.com/repository/puppet ...
{noformat}
 

Jorie Tappa (JIRA)

unread,
Jun 24, 2019, 4:41:03 PM6/24/19
to puppe...@googlegroups.com
Jorie Tappa updated an issue
Change By: Jorie Tappa
Team: Coremunity

Josh Cooper (JIRA)

unread,
Oct 1, 2019, 11:35:03 PM10/1/19
to puppe...@googlegroups.com
Josh Cooper updated an issue
Change By: Josh Cooper
Sprint: Platform Core KANBAN

Josh Cooper (JIRA)

unread,
Oct 1, 2019, 11:35:03 PM10/1/19
to puppe...@googlegroups.com
Josh Cooper assigned an issue to Jorie Tappa
Change By: Josh Cooper
Assignee: Jorie Tappa

Josh Cooper (JIRA)

unread,
Oct 4, 2019, 6:55:02 PM10/4/19
to puppe...@googlegroups.com
Josh Cooper updated an issue
Change By: Josh Cooper
Fix Version/s: PUP 6.10.1

Josh Cooper (JIRA)

unread,
Oct 4, 2019, 6:59:03 PM10/4/19
to puppe...@googlegroups.com
Josh Cooper updated an issue
Change By: Josh Cooper
Release Notes Summary: If the Puppet[:module_repository] URL includes credentials, then redact them when connecting to the forge.
Release Notes: Bug Fix

Josh Cooper (JIRA)

unread,
Oct 4, 2019, 7:23:03 PM10/4/19
to puppe...@googlegroups.com

Josh Cooper (JIRA)

unread,
Oct 4, 2019, 7:23:03 PM10/4/19
to puppe...@googlegroups.com
Josh Cooper commented on Bug PUP-9787

Jean Bond (JIRA)

unread,
Oct 9, 2019, 6:59:03 PM10/9/19
to puppe...@googlegroups.com
Jean Bond commented on Bug PUP-9787

Jorie Tappa, is this fix in 6.10.1 only, not in 6.4.4 or 5.5.17?

Josh Cooper (JIRA)

unread,
Oct 9, 2019, 7:14:03 PM10/9/19
to puppe...@googlegroups.com
Josh Cooper commented on Bug PUP-9787

Yep just 6.10.1

Jean Bond (JIRA)

unread,
Oct 10, 2019, 11:45:03 AM10/10/19
to puppe...@googlegroups.com
Jean Bond commented on Bug PUP-9787

Thank you Josh Cooper!

Jean Bond (JIRA)

unread,
Oct 10, 2019, 11:46:03 AM10/10/19
to puppe...@googlegroups.com
Jean Bond updated an issue
 
Change By: Jean Bond
Labels: resolved-issue-added
Reply all
Reply to author
Forward
0 new messages