| Summary: | <app-admin/salt-2015.5.8: git module leaks authentication details into log | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | trivial | CC: | chutzpah |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://bugzilla.redhat.com/show_bug.cgi?id=1257154 | ||
| Whiteboard: | ~3 [noglsa] | ||
| Package list: | Runtime testing required: | --- | |
2015.5.3 has been cleaned which complete removes all vulnerable versions. https://github.com/saltstack/salt/commit/28aa9b105804ff433d8f663b2f9b804f2b75495a |
From ${URL} : It was found that calling git.clone with https user/pass will leak the authentication details to the log. Upstream patch: https://github.com/saltstack/salt/commit/28aa9b105804ff433d8f663b2f9b804f2b75495a @maintainer(s): since the fixed version is already in the tree, please remove the affected versions.