[
https://issues.apache.org/jira/browse/QPID-6724?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14726198#comment-14726198
]
ASF subversion and git services commented on QPID-6724:
-------------------------------------------------------
Commit 1700671 from [~k-wall] in branch 'java/trunk'
[ https://svn.apache.org/r1700671 ]
QPID-6724: [Java Broker] Stop writing all usernames within an external password
database to the log
* Also moderated some logging from INFO down to DEBUG
> Stop writing all usernames within an external password database to the log
> --------------------------------------------------------------------------
>
> Key: QPID-6724
> URL: https://issues.apache.org/jira/browse/QPID-6724
> Project: Qpid
> Issue Type: Bug
> Components: Java Broker
> Reporter: Keith Wall
> Priority: Minor
> Fix For: qpid-java-6.0
>
>
> Currently the Java Broker on start-up, if using an PlainPasswordFile or
> Base64MD5PasswordFile authentication provider, the names of all users
> contained within the password database are logged at INFO to the log. Even
> though their passwords are not revealed, this seems dubious: it could still
> assist a a malicious person successfully compromise an account.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
