Open
Bug 1641145
Opened 6 years ago
Backtrace reveals user password
Categories
(Bugzilla :: User Accounts, defect)
Tracking
()
UNCONFIRMED
People
(Reporter: u20230201, Unassigned)
Details
Attachments
(1 file)
|
197.65 KB,
image/png
|
Details |
backtrace.png
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Steps to reproduce:
I visited a site that I hadn't visited for a few years. It seems since then Bugzilla and the password encryption method was upgraded.
When I tried to log in, password check failed with a taint check (it seems).
Note: I don't know what bugzilla version was being used.
Actual results:
The backtrace displayed, the crypt() call with the user password was displayed.
Expected results:
Preferably sensitive information should be filtered from backtraces.
You need to log in
before you can comment on or make changes to this bug.
Description
•