Bug#984997: [debian-mysql] Bug#984997: mariadb-server-10.5: database password passed in cleartext both on commandline and in environment

Hello, I would agree that passing secrets on the command line is insecure and in this case unnecessary, there is an easy fix for that and it will be implemented. Speaking of environment, AFAIK on modern systems it can be read only by sufficiently privileged user, so I don't see how it is

Bug#984997: [debian-mysql] Bug#984997: mariadb-server-10.5: database password passed in cleartext both on commandline and in environment

On Thu, Mar 11, 2021 at 09:49:03PM +0200, Otto Kekäläinen wrote: > Thanks for looking into this and reporting it. Could you be a bit more > specific what the context is, who can view the command? This is a rather old and wlel-known type of security issue. Typically any local user can view the

Bug#984997: [debian-mysql] Bug#984997: mariadb-server-10.5: database password passed in cleartext both on commandline and in environment

Hello! Thanks for looking into this and reporting it. Could you be a bit more specific what the context is, who can view the command? How do you suggest the password would be passed? I added a couple Galera developers as this script is not maintained in Debian, but inherited from upstream Galera