Skip to content

Accepting a password on the command line is unsafe #22997

New issue
New issue
Open
Open
Accepting a password on the command line is unsafe#22997
Labels
lifecycle/frozenIndicates that an issue or PR should not be auto-closed due to staleness.

Description

@rgov
rgov
opened on Jun 1, 2019

origin/pkg/oc/cli/login/login.go

Line 44 in e5c7d40

%[1]s login localhost:8443 --username=myuser --password=mypass`)

This ought to be removed or at the least there should to be a warning here that this is unsafe. Command line arguments are not protected from sniffing by other users (say, with ps). Environment variables are not exposed in the same way.

Activity

  1. openshift-bot commented on Aug 30, 2019

    @openshift-bot
    openshift-bot
    on Aug 30, 2019
    Contributor

    Issues go stale after 90d of inactivity.

    Mark the issue as fresh by commenting /remove-lifecycle stale.
    Stale issues rot after an additional 30d of inactivity and eventually close.
    Exclude this issue from closing by commenting /lifecycle frozen.

    If this issue is safe to close now please do so with /close.

    /lifecycle stale

  2. openshift-ci-robot
    added
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale.
    on Aug 30, 2019

  3. openshift-bot commented on Sep 29, 2019

    @openshift-bot
    openshift-bot
    on Sep 29, 2019
    Contributor

    Stale issues rot after 30d of inactivity.

    Mark the issue as fresh by commenting /remove-lifecycle rotten.
    Rotten issues close after an additional 30d of inactivity.
    Exclude this issue from closing by commenting /lifecycle frozen.

    If this issue is safe to close now please do so with /close.

    /lifecycle rotten
    /remove-lifecycle stale

  4. openshift-ci-robot
    added
    lifecycle/rottenDenotes an issue or PR that has aged beyond stale and will be auto-closed.
    and removed
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale.
    on Sep 29, 2019

  5. rgov commented on Sep 30, 2019

    @rgov
    rgov
    on Sep 30, 2019
    Author

    /lifecycle frozen

    Security issues should not be closed out for being stale.

  6. openshift-ci-robot
    added
    lifecycle/frozenIndicates that an issue or PR should not be auto-closed due to staleness.
    and removed
    lifecycle/rottenDenotes an issue or PR that has aged beyond stale and will be auto-closed.
    on Sep 30, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    lifecycle/frozenIndicates that an issue or PR should not be auto-closed due to staleness.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions