RussellSpitzer opened a new issue, #17804: URL: https://github.com/apache/iceberg/issues/17804
> After review, this is not considered a serious vulnerability that needs to be kept private. Operator logs are a trusted surface, but Iceberg does not need to print secrets to say that `warehouse` is missing. Filed publicly as log hygiene. # Summary When `warehouse` is not set, `NessieCatalog.warehouseLocation` logs the entire `catalogOptions` map at WARN, then throws. The comment notes that Spark’s `catalogAndIdentifier` can swallow the exception, so they log on purpose. That map is the catalog `initialize` options. It commonly includes Nessie auth (`nessie.authentication.token`, client credentials) and FileIO keys (`s3.secret-access-key`, session tokens, …). The useful message is only that `warehouse` is not set. Fix: log name + missing `warehouse` only, or redact keys matching token / secret / password / credential / authorization. # Affected Maven coordinates * `org.apache.iceberg:iceberg-nessie` # Attacker prerequisites * a Nessie catalog initialized without `warehouse` * read access to process logs at WARN (driver logs, log aggregator) # Impact * Catalog and storage credentials that were only in the catalog config appear in logs * Does not by itself grant table or Nessie access; it copies secrets to a second ACL (logging) # Proof status Source review only. The issue is visible directly from source. # Key source references * `org.apache.iceberg.nessie.NessieCatalog` (`warehouseLocation`, `LOG.warn` with `catalogOptions`) # Related * Spark `Spark3Util.catalogAndIdentifier` — the catch that motivated the WARN (does not need the options map in the log line) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
