|
 |
fe9878 |
From 8fd3bae32bb540a850b64479c56d60f5557bc100 Mon Sep 17 00:00:00 2001
|
|
|
fe9878 |
From: Jack Magne <jmagne@redhat.com>
|
|
|
fe9878 |
Date: Wed, 7 Feb 2018 14:05:13 -0800
|
|
|
fe9878 |
Subject: [PATCH 1/2] Fix Bug 1542210 - pki console configurations that
|
|
|
fe9878 |
involves ldap passwords leave the plain text password in debug logs
|
|
|
fe9878 |
|
|
|
fe9878 |
Simple sensitive data debug log prevention here.
|
|
|
fe9878 |
|
|
|
fe9878 |
Change-Id: Ic409aaf7e392403c6a4c5afb255a421e1d351c46
|
|
|
fe9878 |
(cherry picked from commit ff70df12dd7fc4f801b281233f64bca3c674173b)
|
|
|
fe9878 |
(cherry picked from commit e86691f5a5aba9c2d783ccddf79eb7226c36672c)
|
|
|
fe9878 |
---
|
|
|
fe9878 |
.../cms/src/com/netscape/cms/servlet/admin/AdminServlet.java | 7 ++++---
|
|
|
fe9878 |
1 file changed, 4 insertions(+), 3 deletions(-)
|
|
|
fe9878 |
|
|
|
fe9878 |
diff --git a/base/server/cms/src/com/netscape/cms/servlet/admin/AdminServlet.java b/base/server/cms/src/com/netscape/cms/servlet/admin/AdminServlet.java
|
|
|
fe9878 |
index d983e6c..769e8e4 100644
|
|
|
fe9878 |
--- a/base/server/cms/src/com/netscape/cms/servlet/admin/AdminServlet.java
|
|
|
fe9878 |
+++ b/base/server/cms/src/com/netscape/cms/servlet/admin/AdminServlet.java
|
|
|
fe9878 |
@@ -216,12 +216,13 @@ public class AdminServlet extends HttpServlet {
|
|
|
fe9878 |
pn.equalsIgnoreCase("pin") ||
|
|
|
fe9878 |
pn.equalsIgnoreCase("pwd") ||
|
|
|
fe9878 |
pn.equalsIgnoreCase("pwdagain") ||
|
|
|
fe9878 |
- pn.equalsIgnoreCase("uPasswd")) {
|
|
|
fe9878 |
+ pn.equalsIgnoreCase("uPasswd") ||
|
|
|
fe9878 |
+ pn.equalsIgnoreCase("PASSWORD_CACHE_ADD")) {
|
|
|
fe9878 |
CMS.debug("AdminServlet::service() param name='" + pn +
|
|
|
fe9878 |
- "' value='(sensitive)'");
|
|
|
fe9878 |
+ "' value='(sensitive)'");
|
|
|
fe9878 |
} else {
|
|
|
fe9878 |
CMS.debug("AdminServlet::service() param name='" + pn +
|
|
|
fe9878 |
- "' value='" + httpReq.getParameter(pn) + "'");
|
|
|
fe9878 |
+ "' value='" + httpReq.getParameter(pn) + "'");
|
|
|
fe9878 |
}
|
|
|
fe9878 |
}
|
|
|
fe9878 |
}
|
|
|
fe9878 |
--
|
|
|
fe9878 |
1.8.3.1
|
|
|
fe9878 |
|
|
|
fe9878 |
|
|
|
fe9878 |
From 511001c4aaa8e48de3932b4508846729b2e4ab6b Mon Sep 17 00:00:00 2001
|
|
|
fe9878 |
From: Fraser Tweedale <ftweedal@redhat.com>
|
|
|
fe9878 |
Date: Thu, 8 Feb 2018 15:06:53 +1100
|
|
|
fe9878 |
Subject: [PATCH 2/2] Fix lightweight CA key replication
|
|
|
fe9878 |
|
|
|
fe9878 |
The resolution for issue https://pagure.io/dogtagpki/issue/2654
|
|
|
fe9878 |
caused a regression in lightweight CA key replication. When the
|
|
|
fe9878 |
authorityMonitor encounters a CA whose keys are not present,
|
|
|
fe9878 |
signingUnit initialisation fails (as expected). The signing info
|
|
|
fe9878 |
event logging behaviour introduced in commit
|
|
|
fe9878 |
4551eb1ce6b14e4a37f9c70b3bfd6c9050e13f10 then results in a
|
|
|
fe9878 |
NullPointerException, crashing the authorityMonitor thread.
|
|
|
fe9878 |
|
|
|
fe9878 |
Fix the issue by extracting the signing info event logging behaviour
|
|
|
fe9878 |
to a separate method, and invoke that method as the final step of
|
|
|
fe9878 |
signingUnit initialisation.
|
|
|
fe9878 |
|
|
|
fe9878 |
Fixes: https://pagure.io/dogtagpki/issue/2929
|
|
|
fe9878 |
Change-Id: Ic6663c09c30754f4fb914dcaf0bc2d902aa91473
|
|
|
fe9878 |
(cherry picked from commit 2251f78c22b2e3b23450cdb274207893932cbd0b)
|
|
|
fe9878 |
---
|
|
|
fe9878 |
base/ca/src/com/netscape/ca/CertificateAuthority.java | 5 +++++
|
|
|
fe9878 |
1 file changed, 5 insertions(+)
|
|
|
fe9878 |
|
|
|
fe9878 |
diff --git a/base/ca/src/com/netscape/ca/CertificateAuthority.java b/base/ca/src/com/netscape/ca/CertificateAuthority.java
|
|
|
fe9878 |
index e5d21eb..9aaa9cb 100644
|
|
|
fe9878 |
--- a/base/ca/src/com/netscape/ca/CertificateAuthority.java
|
|
|
fe9878 |
+++ b/base/ca/src/com/netscape/ca/CertificateAuthority.java
|
|
|
fe9878 |
@@ -662,7 +662,10 @@ public class CertificateAuthority
|
|
|
fe9878 |
}
|
|
|
fe9878 |
throw e;
|
|
|
fe9878 |
}
|
|
|
fe9878 |
+ }
|
|
|
fe9878 |
|
|
|
fe9878 |
+ private void generateSigningInfoAuditEvents()
|
|
|
fe9878 |
+ throws EBaseException {
|
|
|
fe9878 |
try {
|
|
|
fe9878 |
|
|
|
fe9878 |
if (isHostAuthority()) {
|
|
|
fe9878 |
@@ -1852,6 +1855,8 @@ public class CertificateAuthority
|
|
|
fe9878 |
throw new ECAException(
|
|
|
fe9878 |
CMS.getUserMessage("CMS_CA_BUILD_CA_CHAIN_FAILED", e.toString()));
|
|
|
fe9878 |
}
|
|
|
fe9878 |
+
|
|
|
fe9878 |
+ generateSigningInfoAuditEvents();
|
|
|
fe9878 |
}
|
|
|
fe9878 |
|
|
|
fe9878 |
/**
|
|
|
fe9878 |
--
|
|
|
fe9878 |
1.8.3.1
|
|
|
fe9878 |
|