RussellSpitzer opened a new issue, #17804:
URL: https://github.com/apache/iceberg/issues/17804

   > After review, this is not considered a serious vulnerability that needs to 
be kept private. Operator logs are a trusted surface, but Iceberg does not need 
to print secrets to say that `warehouse` is missing. Filed publicly as log 
hygiene.
   
   # Summary
   
   When `warehouse` is not set, `NessieCatalog.warehouseLocation` logs the 
entire `catalogOptions` map at WARN, then throws. The comment notes that 
Spark’s `catalogAndIdentifier` can swallow the exception, so they log on 
purpose.
   
   That map is the catalog `initialize` options. It commonly includes Nessie 
auth (`nessie.authentication.token`, client credentials) and FileIO keys 
(`s3.secret-access-key`, session tokens, …). The useful message is only that 
`warehouse` is not set.
   
   Fix: log name + missing `warehouse` only, or redact keys matching token / 
secret / password / credential / authorization.
   
   # Affected Maven coordinates
   
   * `org.apache.iceberg:iceberg-nessie`
   
   # Attacker prerequisites
   
   * a Nessie catalog initialized without `warehouse`
   * read access to process logs at WARN (driver logs, log aggregator)
   
   # Impact
   
   * Catalog and storage credentials that were only in the catalog config 
appear in logs
   * Does not by itself grant table or Nessie access; it copies secrets to a 
second ACL (logging)
   
   # Proof status
   
   Source review only. The issue is visible directly from source.
   
   # Key source references
   
   * `org.apache.iceberg.nessie.NessieCatalog` (`warehouseLocation`, `LOG.warn` 
with `catalogOptions`)
   
   # Related
   
   * Spark `Spark3Util.catalogAndIdentifier` — the catch that motivated the 
WARN (does not need the options map in the log line)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to