200005 - pk12util displays the user's password in plain text, twice

Status: RESOLVED FIXED

(NSS :: Tools, defect, P1)

Description

[Nelson Bolyard (seldom reads bugmail)]

Observe the following output from a run of the pk12util utility, reported in
the n.p.m.crypto newsgroup:

> >>pk12util -i "my.p12" -d "my directory" -v
> >
> > Enter Password or Pin for "NSS Certificate DB": *****
> > Enter password for PKCS12 file: *****
> > Converted from:
> > 73 77 61 6d 70 66 6f 78 31 31  0
> > Converted to:
> >  0 73  0 77  0 61  0 6d  0 70  0 66  0 6f  0 78  0 31  0 31  0  0 

Those last 4 lines show the user's password twice, once in UTF-8 and 
a second time in UCS-2.  This serves no useful purpose, and is a security
flaw.  The code that prints those 4 lines of output should be removed.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Taking bug

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Attachment: ifdef out offending code and remove some dead code.

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

fixed in rev 1.26 of pk12util.c for NSS 3.9