Jira (PUP-3634) Security bug: User resource exposes hashed password when changing password or adding user

[Charlie Sharpsteen (JIRA)]

Title: Message Title

Charlie Sharpsteen commented on PUP-3634   Re: Security bug: User resource exposes hashed password when changing password or adding user Re-produced on current master branch: [root@poss-head-master ~]# puppet resource user test ensure=present password=foobar --debug   Debug: Runtime environment: puppet_version=3.7.3, ruby_version=1.9.3, run_mode=user, default_encoding=UTF-8 Debug: Puppet::Type::User::ProviderDirectoryservice: file /usr/bin/dsimport does not exist Debug: Failed to load library 'ldap' for feature 'ldap' Debug: Puppet::Type::User::ProviderLdap: feature ldap is missing Debug: Puppet::Type::User::ProviderPw: file pw does not exist Debug: Puppet::Type::User::ProviderUser_role_add: file roleadd does not exist Debug: Loaded state in 0.00 seconds   Debug: Executing '/usr/sbin/useradd -p foobar -M test'   Notice: /User[test]/ensure: created Debug: Finishing transaction 23502560 Debug: Storing state Debug: Stored state in 0.02 seconds user { 'test': ensure => 'present', password => 'foobar', } Add Comment   This message was sent by Atlassian JIRA (v6.3.7#6337-sha1:2ed701e) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.