[
https://issues.apache.org/jira/browse/CASSANDRA-21686?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18115442#comment-18115442
]
Bohdan Siryk commented on CASSANDRA-21686:
------------------------------------------
Pull request - [https://github.com/apache/cassandra/pull/5165]
After change:
{code:java}
cqlsh> SELECT * FROM system_views.settings WHERE name LIKE
'%default_role_initializer%'; name | value
-------------------------------------+----------------------------------------------------
default_role_initializer.class_name |
PasswordDefaultRoleInitializer
default_role_initializer.parameters |
{"role":"cassandra1","password_hash":"<REDACTED>"} {code}
> Leaked raw password_hash in system_views.settings
> -------------------------------------------------
>
> Key: CASSANDRA-21686
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21686
> Project: Apache Cassandra
> Issue Type: Bug
> Reporter: Bohdan Siryk
> Priority: Normal
> Time Spent: 10m
> Remaining Estimate: 0h
>
> CASSANDRA-21546 introduced a pluggable default role initializer, and its
> parameters are visible in {*}system_views.settings{*}. Settings with
> _{_}password{_} are redacted, but with _hash_ (e.g. \{_}password{_}_hash)
> suffix are visible.
> {code:java}
> cqlsh> SELECT * FROM system_views.settings WHERE name LIKE
> '%default_role_initializer%'; name | value
> -------------------------------------+------------------------------------------------------------------------------------------------------
> default_role_initializer.class_name |
> PasswordDefaultRoleInitializer
> default_role_initializer.parameters |
> {"role":"cassandra1","password_hash":"$2a$04$wsvzFamDJPDrTwMjgfcgpO.mKc.CMEuHBFZSjhGz2Ts6.v8PUO2rC"}
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
