Bug#1038139: debci-worker: Process leaks authentication data via amqp-tools

2023-06-16 Thread Christian Kastner
On 2023-06-16 17:56, Antonio Terceiro wrote: > Note that the variable where you inserted a username and password is > calle debci_amqp_server, and was never supposed to be used for putting a > password in plain text. I think this is where the documentation of the --amqp option threw me off, from d

Bug#1038139: debci-worker: Process leaks authentication data via amqp-tools

2023-06-16 Thread Antonio Terceiro
On Thu, Jun 15, 2023 at 10:48:57PM +0200, Christian Kastner wrote: > > Package: debci > Version: 3.6 > Severity: serious > Tags: security > X-Debbugs-Cc: Debian Security Team > > Hi, > > When using authentication in AMQP connections, the username and password > supplied in the --url option to a

Bug#1038139: debci-worker: Process leaks authentication data via amqp-tools

2023-06-15 Thread Christian Kastner
Package: debci Version: 3.6 Severity: serious Tags: security X-Debbugs-Cc: Debian Security Team Hi, When using authentication in AMQP connections, the username and password supplied in the --url option to amqp-consume resp. amqp-publish are exposed in the proces list, see #1037322: $ pgrep