You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@dolphinscheduler.apache.org by "licanxue (via GitHub)" <gi...@apache.org> on 2024/09/19 01:06:23 UTC
[I] [Bug] [Dolphin] Printing plaintext passwords in process environment variables [dolphinscheduler]
licanxue opened a new issue, #16628:
URL: https://github.com/apache/dolphinscheduler/issues/16628
### Search before asking
- [X] I had searched in the [issues](https://github.com/apache/dolphinscheduler/issues?q=is%3Aissue) and found no similar issues.
### What happened
Printing plaintext passwords in process environment variables
### What you expected to happen
no passwords showing in process environment variables
### How to reproduce
### Anything else
_No response_
### Version
dev
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] [Dolphin] Printing plaintext passwords in process environment variables [dolphinscheduler]
Posted by "licanxue (via GitHub)" <gi...@apache.org>.
licanxue commented on issue #16628:
URL: https://github.com/apache/dolphinscheduler/issues/16628#issuecomment-2359835355
We used DolphinScheduler as a scheduling tool in our project, and during our security testing we found that we executed the ‘ps -ef‘ command to query Dolphin's process on the machine where DolphinScheduler was installed, and then we viewed the process by the command ‘cat /proc/procId/environ‘ environment variable information, in which the password is shown in clear text, it is determined to be a security issue, may I ask how to fix it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Question] [Dolphin] Printing plaintext passwords in process environment variables [dolphinscheduler]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #16628:
URL: https://github.com/apache/dolphinscheduler/issues/16628#issuecomment-2614149273
This issue has been automatically marked as stale because it has not had recent activity for 30 days. It will be closed in next 7 days if no further activity occurs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] [Dolphin] Printing plaintext passwords in process environment variables [dolphinscheduler]
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS commented on issue #16628:
URL: https://github.com/apache/dolphinscheduler/issues/16628#issuecomment-2359840652
I don't think this is a cve since most open source tools store the account password in plain text in the service's configuration file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Question] [Dolphin] Printing plaintext passwords in process environment variables [dolphinscheduler]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #16628:
URL: https://github.com/apache/dolphinscheduler/issues/16628#issuecomment-2629177463
This issue has been closed because it has not received response for too long time. You could reopen it if you encountered similar problems in the future.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] [Dolphin] Printing plaintext passwords in process environment variables [dolphinscheduler]
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS commented on issue #16628:
URL: https://github.com/apache/dolphinscheduler/issues/16628#issuecomment-2359720390
Can you elaborate your issue? I don't quite understand what this is.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Question] [Dolphin] Printing plaintext passwords in process environment variables [dolphinscheduler]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #16628: [Question] [Dolphin] Printing plaintext passwords in process environment variables
URL: https://github.com/apache/dolphinscheduler/issues/16628
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org