)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"b9784df673a8cba511dcc290f7feeb9d9dbed989","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Abu Shohel Ahmed \u003cshohel_csdu@yahoo.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-08-15 10:49:50 +0300"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Adds a new OpenStack Security Notes"},{"line_number":8,"context_line":"OSSN-0024: Sensitive data exposure by logging in python-keystoneclient"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Change-Id: I1435dab3f443b39453e1907c647002f8a35df9cb"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"7ac7a964_8f0622cd","line":7,"updated":"2014-08-15 13:05:18.000000000","message":"Please add an empty line after the subject line.\n\nI also suggest to make the subject clearer, mention 0024 in it","commit_id":"b5adc55ec12a64880c324981b10820e837bfa122"}],"security-notes/OSSN-0024":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"c13129ddb693d949bd7e970d8b894192a25352c6","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Python-keystoneclient is a client for OpenStack Identity API, Keystone. Various OpenStack services including OpenStack Dashboard i.e., Horizon, depends on python-keystoneclient to consume Identity API service. A log level security weakness in the python-keystoneclient can expose user sensitive data (e.g., password or token) in the log of the running service. "},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"### Affected Services / Software ###"},{"line_number":8,"context_line":"Python-keystoneclient\u003d\u003c0.10.0"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"1abeadc6_35d6df4f","line":5,"updated":"2014-08-28 18:12:33.000000000","message":"depend","commit_id":"b5adc55ec12a64880c324981b10820e837bfa122"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"c13129ddb693d949bd7e970d8b894192a25352c6","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"### Affected Services / Software ###"},{"line_number":8,"context_line":"Python-keystoneclient\u003d\u003c0.10.0"},{"line_number":9,"context_line":" "},{"line_number":10,"context_line":"### Discussion ###"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Python-Keystoneclient provides python API and commands to make an Identity API requests to OpenStack Identity Service, Keystone.  It handles user sensitive data such as user password and token when request/responses are made toward a Keystone server. Similar to all OpenStack projects, python-keystoneclient uses python Logger to log all request/response activities. When python-keystoneclient runs in log level DEBUG mode, it exposes sensitive data such as user password and token associated with a request/response in the log information. For example:"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"1abeadc6_757057a4","line":9,"updated":"2014-08-28 18:12:33.000000000","message":"Please remove space","commit_id":"b5adc55ec12a64880c324981b10820e837bfa122"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"c13129ddb693d949bd7e970d8b894192a25352c6","unresolved":false,"context_lines":[{"line_number":9,"context_line":" "},{"line_number":10,"context_line":"### Discussion ###"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Python-Keystoneclient provides python API and commands to make an Identity API requests to OpenStack Identity Service, Keystone.  It handles user sensitive data such as user password and token when request/responses are made toward a Keystone server. Similar to all OpenStack projects, python-keystoneclient uses python Logger to log all request/response activities. When python-keystoneclient runs in log level DEBUG mode, it exposes sensitive data such as user password and token associated with a request/response in the log information. For example:"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"---- begin example ----"},{"line_number":15,"context_line":"$keystone --debug user-list"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"1abeadc6_35efbf1f","line":12,"updated":"2014-08-28 18:12:33.000000000","message":"Let\u0027s make it so that words don\u0027t span multiple lines, and we need to have line breaks after each","commit_id":"b5adc55ec12a64880c324981b10820e837bfa122"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"cd5d3c74a4beaf0af3819c997ad3665bccf7fd4f","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Python-keystoneclient is a client for OpenStack Identity API, Keystone. Various"},{"line_number":6,"context_line":"OpenStack services including OpenStack Dashboard i.e., Horizon, depends on"},{"line_number":7,"context_line":"python-keystoneclient to consume Identity API service. A log level security"},{"line_number":8,"context_line":"weakness in the python-keystoneclient can expose user sensitive data (e.g.,"},{"line_number":9,"context_line":"password or token) in the log of the running service."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_a2341f4a","line":6,"updated":"2014-09-05 16:28:30.000000000","message":"*depend","commit_id":"1fd9eb1af02b513e9eff7b55657beaf4e2dbd4f7"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"cd5d3c74a4beaf0af3819c997ad3665bccf7fd4f","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Python-keystoneclient is a client for OpenStack Identity API, Keystone. Various"},{"line_number":6,"context_line":"OpenStack services including OpenStack Dashboard i.e., Horizon, depends on"},{"line_number":7,"context_line":"python-keystoneclient to consume Identity API service. A log level security"},{"line_number":8,"context_line":"weakness in the python-keystoneclient can expose user sensitive data (e.g.,"},{"line_number":9,"context_line":"password or token) in the log of the running service."},{"line_number":10,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_e26f0729","line":7,"updated":"2014-09-05 16:28:30.000000000","message":"This sentence is a little unclear.  Maybe: \"If the logging level is set to xx level, python-keystoneclient may expose sensitive data\"...","commit_id":"1fd9eb1af02b513e9eff7b55657beaf4e2dbd4f7"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"cd5d3c74a4beaf0af3819c997ad3665bccf7fd4f","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Python-Keystoneclient provides python API and commands to make an Identity API"},{"line_number":17,"context_line":"requests to OpenStack Identity Service, Keystone.  It handles user sensitive"},{"line_number":18,"context_line":"data such as user password and token when request/responses are made toward a"},{"line_number":19,"context_line":"Keystone server. Similar to all OpenStack projects, python-keystoneclient uses"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_82cd5b33","line":16,"updated":"2014-09-05 16:28:30.000000000","message":"remove *an","commit_id":"1fd9eb1af02b513e9eff7b55657beaf4e2dbd4f7"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"cd5d3c74a4beaf0af3819c997ad3665bccf7fd4f","unresolved":false,"context_lines":[{"line_number":25,"context_line":"---- begin example ----"},{"line_number":26,"context_line":"$keystone --debug user-list"},{"line_number":27,"context_line":"DEBUG:keystoneclient.session:REQ: curl -i -X POST"},{"line_number":28,"context_line":"    http://10.0.0.15:5000/v2.0/tokens -H \"Content-Type: application/json\" -H"},{"line_number":29,"context_line":"    \"User-Agent: python-keystoneclient\""},{"line_number":30,"context_line":"DEBUG:keystoneclient.session:REQ BODY: {\"auth\": {\"tenantName\": \"admin\","},{"line_number":31,"context_line":"\"passwordCredentials\": {\"username\": \"admin\", \"password\": \"stack\"}}}"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_e204674b","line":28,"updated":"2014-09-05 16:28:30.000000000","message":"Since this line doesn\u0027t contain any credentials, can we leave it out?","commit_id":"1fd9eb1af02b513e9eff7b55657beaf4e2dbd4f7"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"cd5d3c74a4beaf0af3819c997ad3665bccf7fd4f","unresolved":false,"context_lines":[{"line_number":31,"context_line":"\"passwordCredentials\": {\"username\": \"admin\", \"password\": \"stack\"}}}"},{"line_number":32,"context_line":"---- end example ----"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"This sensitive data can potentially be exploited by an inside attacker in"},{"line_number":35,"context_line":"possession of a log file."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Python-keystoneclient is used by Horizon and other Identity consuming services"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_6298771c","line":34,"updated":"2014-09-05 16:28:30.000000000","message":"Maybe change \"inside attacker\" to something like \"an attacker with access to the logs\"","commit_id":"1fd9eb1af02b513e9eff7b55657beaf4e2dbd4f7"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"cd5d3c74a4beaf0af3819c997ad3665bccf7fd4f","unresolved":false,"context_lines":[{"line_number":37,"context_line":"Python-keystoneclient is used by Horizon and other Identity consuming services"},{"line_number":38,"context_line":"to authenticate a user towards Identity API service. A user providing password"},{"line_number":39,"context_line":"or token to these services for authentication could resulted in capture of"},{"line_number":40,"context_line":"these sensitive data in their respective services log file."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"### Recommended Actions ###"},{"line_number":43,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_e28b87c0","line":40,"updated":"2014-09-05 16:28:30.000000000","message":"change these to this","commit_id":"1fd9eb1af02b513e9eff7b55657beaf4e2dbd4f7"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"cd5d3c74a4beaf0af3819c997ad3665bccf7fd4f","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"### Recommended Actions ###"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Latest python-keystoneclient\u003d0.10.1 has addressed this security weakness by not"},{"line_number":45,"context_line":"exposing user password and token in log information. Any service using the"},{"line_number":46,"context_line":"latest version of Python-keystoneclient\u003d0.10.1 is not affected by this security"},{"line_number":47,"context_line":"weakness. Other services using old python-keystoneclient should upgrade to the"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_62bf9761","line":44,"updated":"2014-09-05 16:28:30.000000000","message":"*The latest python....","commit_id":"1fd9eb1af02b513e9eff7b55657beaf4e2dbd4f7"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"4524cba8ee66984fadae63e5a2517f3fa71098bf","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Sensitive data exposure in log infomration by python-keystoneclient"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_22a62cc2","line":1,"updated":"2014-09-08 21:16:48.000000000","message":"Typo","commit_id":"dda6a8ee7a52479e6d35d66dc14d3ad554bb23ad"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"4524cba8ee66984fadae63e5a2517f3fa71098bf","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Python-keystoneclient is a client tool for OpenStack Identity API, Keystone."},{"line_number":6,"context_line":"Various OpenStack services including OpenStack Dashboard i.e., Horizon, depend"},{"line_number":7,"context_line":"on python-keystoneclient to consume Identity API service. A particular log level"},{"line_number":8,"context_line":"security weakness in python-keystoneclient can expose user sensitive data"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_e2c42461","line":5,"updated":"2014-09-08 21:16:48.000000000","message":"Lines need to be \u003c\u003d 72 chars.","commit_id":"dda6a8ee7a52479e6d35d66dc14d3ad554bb23ad"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"4524cba8ee66984fadae63e5a2517f3fa71098bf","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"},{"line_number":12,"context_line":"Python-keystoneclient\u003d\u003c0.10.0"},{"line_number":13,"context_line":" "},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":"Python-Keystoneclient provides python APIs and commands for Identity API"},{"line_number":16,"context_line":"requests to OpenStack Identity Service, Keystone. It handles user sensitive data"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_82cd1889","line":13,"updated":"2014-09-08 21:16:48.000000000","message":"Whitespace here","commit_id":"dda6a8ee7a52479e6d35d66dc14d3ad554bb23ad"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"4524cba8ee66984fadae63e5a2517f3fa71098bf","unresolved":false,"context_lines":[{"line_number":15,"context_line":"Python-Keystoneclient provides python APIs and commands for Identity API"},{"line_number":16,"context_line":"requests to OpenStack Identity Service, Keystone. It handles user sensitive data"},{"line_number":17,"context_line":"such as user password and tokens during requests/responses toward a Keystone"},{"line_number":18,"context_line":"server. Similar to all OpenStack projects, python-keystoneclient uses python"},{"line_number":19,"context_line":"Logger to log request/response activities. When python-keystoneclient runs in"},{"line_number":20,"context_line":"log level DEBUG mode, a particular security weakness exposes sensitive data such"},{"line_number":21,"context_line":"as user password and token associated with a request/response in log information."}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_62875410","line":18,"updated":"2014-09-08 21:16:48.000000000","message":"I would change this sentence to \"Like all OpenStack projects,\"...","commit_id":"dda6a8ee7a52479e6d35d66dc14d3ad554bb23ad"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"4524cba8ee66984fadae63e5a2517f3fa71098bf","unresolved":false,"context_lines":[{"line_number":17,"context_line":"such as user password and tokens during requests/responses toward a Keystone"},{"line_number":18,"context_line":"server. Similar to all OpenStack projects, python-keystoneclient uses python"},{"line_number":19,"context_line":"Logger to log request/response activities. When python-keystoneclient runs in"},{"line_number":20,"context_line":"log level DEBUG mode, a particular security weakness exposes sensitive data such"},{"line_number":21,"context_line":"as user password and token associated with a request/response in log information."},{"line_number":22,"context_line":"For example:"},{"line_number":23,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_a2c69c47","line":20,"updated":"2014-09-08 21:16:48.000000000","message":"This sentence is a little awkward.  Maybe we want to say something like \"When python-keystoneclient runs with a log level of DEBUG, sensitive data such as user passwords and tokens...\"","commit_id":"dda6a8ee7a52479e6d35d66dc14d3ad554bb23ad"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"4524cba8ee66984fadae63e5a2517f3fa71098bf","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Python-keystoneclient is used by Horizon and other Identity consuming services"},{"line_number":37,"context_line":"to authenticate a user towards Identity API service, Keystone. A user providing"},{"line_number":38,"context_line":"password or token for authentication to these services could resulted in capture"},{"line_number":39,"context_line":"of this sensitive data in the respective services log files."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_82d0b8f8","line":38,"updated":"2014-09-08 21:16:48.000000000","message":"could *result;  in *the* capture","commit_id":"dda6a8ee7a52479e6d35d66dc14d3ad554bb23ad"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"4524cba8ee66984fadae63e5a2517f3fa71098bf","unresolved":false,"context_lines":[{"line_number":36,"context_line":"Python-keystoneclient is used by Horizon and other Identity consuming services"},{"line_number":37,"context_line":"to authenticate a user towards Identity API service, Keystone. A user providing"},{"line_number":38,"context_line":"password or token for authentication to these services could resulted in capture"},{"line_number":39,"context_line":"of this sensitive data in the respective services log files."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"### Recommended Actions ###"},{"line_number":42,"context_line":"The latest python-keystoneclient\u003d0.10.1 has addressed this security weakness by"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_e2d7c4eb","line":39,"updated":"2014-09-08 21:16:48.000000000","message":"sensitive data *from* the respective services log files","commit_id":"dda6a8ee7a52479e6d35d66dc14d3ad554bb23ad"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"4524cba8ee66984fadae63e5a2517f3fa71098bf","unresolved":false,"context_lines":[{"line_number":46,"context_line":"latest version\u003d0.10.1. For a fresh installation of a service which depends on"},{"line_number":47,"context_line":"pythone-keystoneclient, make sure it uses python-keystoneclient\u003d0.10.1. One way"},{"line_number":48,"context_line":"to do this is to set specific version information in the requirments.txt file."},{"line_number":49,"context_line":"For example, in Horizon update horizon/requirements.txt file:"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"---- begin example ----"},{"line_number":52,"context_line":"python-keystoneclient\u003e\u003d0.10.1"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_e2eee4b3","line":49,"updated":"2014-09-08 21:16:48.000000000","message":"For example, in Horizon, update","commit_id":"dda6a8ee7a52479e6d35d66dc14d3ad554bb23ad"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"4524cba8ee66984fadae63e5a2517f3fa71098bf","unresolved":false,"context_lines":[{"line_number":52,"context_line":"python-keystoneclient\u003e\u003d0.10.1"},{"line_number":53,"context_line":"---- end example ----"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"or for existing installation upgrade the python-keystoneclient to the latest"},{"line_number":56,"context_line":"version:"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"---- begin example ----"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_4235f044","line":55,"updated":"2014-09-08 21:16:48.000000000","message":"existing *installations*","commit_id":"dda6a8ee7a52479e6d35d66dc14d3ad554bb23ad"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"30ee5865ceb2e6bd4c1dda0d6526501fbaaabdf0","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Python-keystoneclient is a client tool for OpenStack Identity API,"},{"line_number":6,"context_line":"Keystone. Various OpenStack services including OpenStack Dashboard"},{"line_number":7,"context_line":"i.e., Horizon, depend on python-keystoneclient to consume Identity API"},{"line_number":8,"context_line":"service. A particular log level security weakness in"},{"line_number":9,"context_line":"python-keystoneclient can expose user sensitive data (e.g., password or"},{"line_number":10,"context_line":"token) in log information."}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_65de1a6f","line":7,"updated":"2014-09-11 16:48:20.000000000","message":"(nit) ...consume *the* Identity...","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"30ee5865ceb2e6bd4c1dda0d6526501fbaaabdf0","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Discussion ###"},{"line_number":16,"context_line":"Python-keystoneclient provides python APIs and commands for Identity"},{"line_number":17,"context_line":"API requests to OpenStack Identity Service, Keystone. It handles user"},{"line_number":18,"context_line":"sensitive data such as user password and tokens during requests or"},{"line_number":19,"context_line":"responses toward a Keystone server. Like all OpenStack projects,"},{"line_number":20,"context_line":"python-keystoneclient uses python Logger to log request/response"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_05f54e56","line":17,"updated":"2014-09-11 16:48:20.000000000","message":"(nit) ...to *the* OpenStack...","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"30ee5865ceb2e6bd4c1dda0d6526501fbaaabdf0","unresolved":false,"context_lines":[{"line_number":16,"context_line":"Python-keystoneclient provides python APIs and commands for Identity"},{"line_number":17,"context_line":"API requests to OpenStack Identity Service, Keystone. It handles user"},{"line_number":18,"context_line":"sensitive data such as user password and tokens during requests or"},{"line_number":19,"context_line":"responses toward a Keystone server. Like all OpenStack projects,"},{"line_number":20,"context_line":"python-keystoneclient uses python Logger to log request/response"},{"line_number":21,"context_line":"activities. When a python-keystoneclient runs in a log level DEBUG mode,"},{"line_number":22,"context_line":"a log level security weakness exposes sensitive data such as user"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_e55f6ae3","line":19,"updated":"2014-09-11 16:48:20.000000000","message":"I would say \"...when sending requests to and receiving responses from a Keystone Server.\".","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"30ee5865ceb2e6bd4c1dda0d6526501fbaaabdf0","unresolved":false,"context_lines":[{"line_number":18,"context_line":"sensitive data such as user password and tokens during requests or"},{"line_number":19,"context_line":"responses toward a Keystone server. Like all OpenStack projects,"},{"line_number":20,"context_line":"python-keystoneclient uses python Logger to log request/response"},{"line_number":21,"context_line":"activities. When a python-keystoneclient runs in a log level DEBUG mode,"},{"line_number":22,"context_line":"a log level security weakness exposes sensitive data such as user"},{"line_number":23,"context_line":"password and token associated with a request/response in log"},{"line_number":24,"context_line":"information. For example:"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_65737a80","line":21,"updated":"2014-09-11 16:48:20.000000000","message":"(nit) remove the word \"a\" and reword this a bit:\n\n  \"When python-keystoneclient runs with the DEBUG log level enabled, a security weakness...\"","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"ebc6b676fb7ad501077327d983e6bbdc25cd7a20","unresolved":false,"context_lines":[{"line_number":19,"context_line":"responses toward a Keystone server. Like all OpenStack projects,"},{"line_number":20,"context_line":"python-keystoneclient uses python Logger to log request/response"},{"line_number":21,"context_line":"activities. When a python-keystoneclient runs in a log level DEBUG mode,"},{"line_number":22,"context_line":"a log level security weakness exposes sensitive data such as user"},{"line_number":23,"context_line":"password and token associated with a request/response in log"},{"line_number":24,"context_line":"information. For example:"},{"line_number":25,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_fb4af825","line":22,"updated":"2014-09-09 15:57:42.000000000","message":"I think saying \"log level\" again here is redundant","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"30ee5865ceb2e6bd4c1dda0d6526501fbaaabdf0","unresolved":false,"context_lines":[{"line_number":19,"context_line":"responses toward a Keystone server. Like all OpenStack projects,"},{"line_number":20,"context_line":"python-keystoneclient uses python Logger to log request/response"},{"line_number":21,"context_line":"activities. When a python-keystoneclient runs in a log level DEBUG mode,"},{"line_number":22,"context_line":"a log level security weakness exposes sensitive data such as user"},{"line_number":23,"context_line":"password and token associated with a request/response in log"},{"line_number":24,"context_line":"information. For example:"},{"line_number":25,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_4512f609","line":22,"in_reply_to":"fa98f980_fb4af825","updated":"2014-09-11 16:48:20.000000000","message":"+1.  My proposed wording above eliminates this redundancy.","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"30ee5865ceb2e6bd4c1dda0d6526501fbaaabdf0","unresolved":false,"context_lines":[{"line_number":20,"context_line":"python-keystoneclient uses python Logger to log request/response"},{"line_number":21,"context_line":"activities. When a python-keystoneclient runs in a log level DEBUG mode,"},{"line_number":22,"context_line":"a log level security weakness exposes sensitive data such as user"},{"line_number":23,"context_line":"password and token associated with a request/response in log"},{"line_number":24,"context_line":"information. For example:"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"---- begin example ----"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_e52daa47","line":23,"updated":"2014-09-11 16:48:20.000000000","message":"(nit) \"passwords and tokens\" and \"requests/responses\"","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"30ee5865ceb2e6bd4c1dda0d6526501fbaaabdf0","unresolved":false,"context_lines":[{"line_number":37,"context_line":"access to the log file."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Python-keystoneclient is used by Horizon and other Identity consuming"},{"line_number":40,"context_line":"services to authenticate a user towards Identity API service, Keystone."},{"line_number":41,"context_line":"A user providing password or token for authentication to these services"},{"line_number":42,"context_line":"could result in capture of this sensitive data in the respective"},{"line_number":43,"context_line":"services log files."}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_e5a20aad","line":40,"updated":"2014-09-11 16:48:20.000000000","message":"(nit) Use the word \"against\" instead of \"towards\" and add the word \"the\":\n\n  \"...authenticate a user against the Identity...\"","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"ebc6b676fb7ad501077327d983e6bbdc25cd7a20","unresolved":false,"context_lines":[{"line_number":39,"context_line":"Python-keystoneclient is used by Horizon and other Identity consuming"},{"line_number":40,"context_line":"services to authenticate a user towards Identity API service, Keystone."},{"line_number":41,"context_line":"A user providing password or token for authentication to these services"},{"line_number":42,"context_line":"could result in capture of this sensitive data in the respective"},{"line_number":43,"context_line":"services log files."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_bb26b066","line":42,"updated":"2014-09-09 15:57:42.000000000","message":"result in *the* capture","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"30ee5865ceb2e6bd4c1dda0d6526501fbaaabdf0","unresolved":false,"context_lines":[{"line_number":39,"context_line":"Python-keystoneclient is used by Horizon and other Identity consuming"},{"line_number":40,"context_line":"services to authenticate a user towards Identity API service, Keystone."},{"line_number":41,"context_line":"A user providing password or token for authentication to these services"},{"line_number":42,"context_line":"could result in capture of this sensitive data in the respective"},{"line_number":43,"context_line":"services log files."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_65961a4e","line":42,"in_reply_to":"fa98f980_bb26b066","updated":"2014-09-11 16:48:20.000000000","message":"+1","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"30ee5865ceb2e6bd4c1dda0d6526501fbaaabdf0","unresolved":false,"context_lines":[{"line_number":43,"context_line":"services log files."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"### Recommended Actions ###"},{"line_number":46,"context_line":"The latest python-keystoneclient\u003d0.10.1 has addressed this security"},{"line_number":47,"context_line":"weakness by not exposing user password and token in log information."},{"line_number":48,"context_line":"Any service using the latest version of python-keystoneclient\u003d0.10.1 is"},{"line_number":49,"context_line":"not affected by this security weakness. Other services using old"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_0532ae5e","line":46,"updated":"2014-09-11 16:48:20.000000000","message":"The way we mention the version number throughout this whole section is a bit odd.  How about this?:\n\n\"Version 0.10.1 of python-keystoneclient has addressed...\"\n\nLater in this paragraph where you mention the version, you can then just say:\n\n\"...a fixed version of python-keystoneclient...\"","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"30ee5865ceb2e6bd4c1dda0d6526501fbaaabdf0","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"### Recommended Actions ###"},{"line_number":46,"context_line":"The latest python-keystoneclient\u003d0.10.1 has addressed this security"},{"line_number":47,"context_line":"weakness by not exposing user password and token in log information."},{"line_number":48,"context_line":"Any service using the latest version of python-keystoneclient\u003d0.10.1 is"},{"line_number":49,"context_line":"not affected by this security weakness. Other services using old"},{"line_number":50,"context_line":"python-keystoneclient should upgrade to the latest version\u003d0.10.1. For"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_857a1e22","line":47,"updated":"2014-09-11 16:48:20.000000000","message":"I\u0027d reword this:\n\n  \"...and token information in log statements.\"","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"30ee5865ceb2e6bd4c1dda0d6526501fbaaabdf0","unresolved":false,"context_lines":[{"line_number":47,"context_line":"weakness by not exposing user password and token in log information."},{"line_number":48,"context_line":"Any service using the latest version of python-keystoneclient\u003d0.10.1 is"},{"line_number":49,"context_line":"not affected by this security weakness. Other services using old"},{"line_number":50,"context_line":"python-keystoneclient should upgrade to the latest version\u003d0.10.1. For"},{"line_number":51,"context_line":"a fresh installation of a service which depends on"},{"line_number":52,"context_line":"pythone-keystoneclient, make sure it uses python-keystoneclient\u003d0.10.1."},{"line_number":53,"context_line":"One way to do this is to set specific version information in the"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_c571860d","line":50,"updated":"2014-09-11 16:48:20.000000000","message":"Make this a new paragraph starting with \"For\".","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"30ee5865ceb2e6bd4c1dda0d6526501fbaaabdf0","unresolved":false,"context_lines":[{"line_number":58,"context_line":"python-keystoneclient\u003e\u003d0.10.1"},{"line_number":59,"context_line":"---- end example ----"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"or for existing installations upgrade the python-keystoneclient to the"},{"line_number":62,"context_line":"latest version:"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"---- begin example ----"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_c548a6b5","line":61,"updated":"2014-09-11 16:48:20.000000000","message":"Make this a new sentence and do a bit of rewording:\n\n\"For existing installations, upgrade python-keystoneclient...\"","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"30ee5865ceb2e6bd4c1dda0d6526501fbaaabdf0","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"### Contacts / References ###"},{"line_number":72,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0024"},{"line_number":73,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1004114"},{"line_number":74,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":75,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_e5ef6a85","line":73,"updated":"2014-09-11 16:48:20.000000000","message":"This should be the link to the python-keystone client bug, not the OSSN bug:\n\nhttps://bugs.launchpad.net/python-keystoneclient/+bug/1004114","commit_id":"8a939d407d8de5f4441fb9df6cd65dfe0b5b7b5d"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"634fc46185ab2623b728261f19d58b39ebe07370","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Python-keystoneclient is a client tool for OpenStack Identity API,"},{"line_number":6,"context_line":"Keystone. Various OpenStack services including OpenStack Dashboard"},{"line_number":7,"context_line":"i.e., Horizon, depend on python-keystoneclient to consume the Identity"},{"line_number":8,"context_line":"API service. A particular log level security weakness in"}],"source_content_type":"application/octet-stream","patch_set":9,"id":"fa98f980_b3f02dfe","line":5,"updated":"2014-09-12 14:41:16.000000000","message":"for *the* OpenStack Identity API,","commit_id":"3ea0ffdec7406bb707894297dfaf111a46afae78"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"881c515ea5ca91f92d746c8598459d33a4e21134","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Python-keystoneclient is a client tool for OpenStack Identity API,"},{"line_number":6,"context_line":"Keystone. Various OpenStack services including OpenStack Dashboard"},{"line_number":7,"context_line":"i.e., Horizon, depend on python-keystoneclient to consume the Identity"},{"line_number":8,"context_line":"API service. A particular log level security weakness in"}],"source_content_type":"application/octet-stream","patch_set":9,"id":"fa98f980_ad0def90","line":5,"in_reply_to":"fa98f980_b3f02dfe","updated":"2014-09-15 22:12:27.000000000","message":"If you are trying to refer to Keystone, you should say \"OpenStack Identity Service\".  For this sentence, I think the following would be good:\n\n\"Python-keystoneclient is a client tool for the OpenStack Identity API, which is implemented by the Keystone project.\"","commit_id":"3ea0ffdec7406bb707894297dfaf111a46afae78"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"634fc46185ab2623b728261f19d58b39ebe07370","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Python-keystoneclient is a client tool for OpenStack Identity API,"},{"line_number":6,"context_line":"Keystone. Various OpenStack services including OpenStack Dashboard"},{"line_number":7,"context_line":"i.e., Horizon, depend on python-keystoneclient to consume the Identity"},{"line_number":8,"context_line":"API service. A particular log level security weakness in"},{"line_number":9,"context_line":"python-keystoneclient can expose user sensitive data (e.g., password or"}],"source_content_type":"application/octet-stream","patch_set":9,"id":"fa98f980_53e1c128","line":6,"updated":"2014-09-12 14:41:16.000000000","message":"including *the* OpenStack Dashboard","commit_id":"3ea0ffdec7406bb707894297dfaf111a46afae78"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"881c515ea5ca91f92d746c8598459d33a4e21134","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Python-keystoneclient is a client tool for OpenStack Identity API,"},{"line_number":6,"context_line":"Keystone. Various OpenStack services including OpenStack Dashboard"},{"line_number":7,"context_line":"i.e., Horizon, depend on python-keystoneclient to consume the Identity"},{"line_number":8,"context_line":"API service. A particular log level security weakness in"},{"line_number":9,"context_line":"python-keystoneclient can expose user sensitive data (e.g., password or"},{"line_number":10,"context_line":"token) in log statements."}],"source_content_type":"application/octet-stream","patch_set":9,"id":"fa98f980_0da8bb1e","line":7,"updated":"2014-09-15 22:12:27.000000000","message":"I don\u0027t even know that you need to mention Horizon by name here.  The \"i.e.\" reference just makes this harder to read here.","commit_id":"3ea0ffdec7406bb707894297dfaf111a46afae78"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"881c515ea5ca91f92d746c8598459d33a4e21134","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Python-keystoneclient is a client tool for OpenStack Identity API,"},{"line_number":6,"context_line":"Keystone. Various OpenStack services including OpenStack Dashboard"},{"line_number":7,"context_line":"i.e., Horizon, depend on python-keystoneclient to consume the Identity"},{"line_number":8,"context_line":"API service. A particular log level security weakness in"},{"line_number":9,"context_line":"python-keystoneclient can expose user sensitive data (e.g., password or"},{"line_number":10,"context_line":"token) in log statements."},{"line_number":11,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":9,"id":"fa98f980_ad840fd3","line":8,"updated":"2014-09-15 22:12:27.000000000","message":"I would say \"Identity API\" and just drop service.","commit_id":"3ea0ffdec7406bb707894297dfaf111a46afae78"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"881c515ea5ca91f92d746c8598459d33a4e21134","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Python-keystoneclient\u003d\u003c0.10.0"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Discussion ###"},{"line_number":16,"context_line":"Python-keystoneclient provides python APIs and commands for Identity"},{"line_number":17,"context_line":"API requests to the OpenStack Identity Service, Keystone. It handles"},{"line_number":18,"context_line":"user sensitive data such as user password and tokens when sending "},{"line_number":19,"context_line":"requests or receiving responses from a Keystone server. Like all"}],"source_content_type":"application/octet-stream","patch_set":9,"id":"fa98f980_8d42eb65","line":16,"updated":"2014-09-15 22:12:27.000000000","message":"APIs are not really provided by python-keystoneclient.  We should probably say that it provides an interface for making Identity API requests against Keystone.","commit_id":"3ea0ffdec7406bb707894297dfaf111a46afae78"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"634fc46185ab2623b728261f19d58b39ebe07370","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Discussion ###"},{"line_number":16,"context_line":"Python-keystoneclient provides python APIs and commands for Identity"},{"line_number":17,"context_line":"API requests to the OpenStack Identity Service, Keystone. It handles"},{"line_number":18,"context_line":"user sensitive data such as user password and tokens when sending "},{"line_number":19,"context_line":"requests or receiving responses from a Keystone server. Like all"},{"line_number":20,"context_line":"OpenStack projects, python-keystoneclient uses python Logger to log"}],"source_content_type":"application/octet-stream","patch_set":9,"id":"fa98f980_13f739d4","line":17,"updated":"2014-09-12 14:41:16.000000000","message":"We shouldn\u0027t start a sentence with \"it\".  We could say \"Keystone\" handles user sensitive data...","commit_id":"3ea0ffdec7406bb707894297dfaf111a46afae78"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"881c515ea5ca91f92d746c8598459d33a4e21134","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Discussion ###"},{"line_number":16,"context_line":"Python-keystoneclient provides python APIs and commands for Identity"},{"line_number":17,"context_line":"API requests to the OpenStack Identity Service, Keystone. It handles"},{"line_number":18,"context_line":"user sensitive data such as user password and tokens when sending "},{"line_number":19,"context_line":"requests or receiving responses from a Keystone server. Like all"},{"line_number":20,"context_line":"OpenStack projects, python-keystoneclient uses python Logger to log"}],"source_content_type":"application/octet-stream","patch_set":9,"id":"fa98f980_ed2297ff","line":17,"in_reply_to":"fa98f980_13f739d4","updated":"2014-09-15 22:12:27.000000000","message":"+1.","commit_id":"3ea0ffdec7406bb707894297dfaf111a46afae78"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"634fc46185ab2623b728261f19d58b39ebe07370","unresolved":false,"context_lines":[{"line_number":15,"context_line":"### Discussion ###"},{"line_number":16,"context_line":"Python-keystoneclient provides python APIs and commands for Identity"},{"line_number":17,"context_line":"API requests to the OpenStack Identity Service, Keystone. It handles"},{"line_number":18,"context_line":"user sensitive data such as user password and tokens when sending "},{"line_number":19,"context_line":"requests or receiving responses from a Keystone server. Like all"},{"line_number":20,"context_line":"OpenStack projects, python-keystoneclient uses python Logger to log"},{"line_number":21,"context_line":"request/response activities. When python-keystoneclient runs with the"}],"source_content_type":"application/octet-stream","patch_set":9,"id":"fa98f980_d3f5b1ed","line":18,"updated":"2014-09-12 14:41:16.000000000","message":"whitespace here","commit_id":"3ea0ffdec7406bb707894297dfaf111a46afae78"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"634fc46185ab2623b728261f19d58b39ebe07370","unresolved":false,"context_lines":[{"line_number":17,"context_line":"API requests to the OpenStack Identity Service, Keystone. It handles"},{"line_number":18,"context_line":"user sensitive data such as user password and tokens when sending "},{"line_number":19,"context_line":"requests or receiving responses from a Keystone server. Like all"},{"line_number":20,"context_line":"OpenStack projects, python-keystoneclient uses python Logger to log"},{"line_number":21,"context_line":"request/response activities. When python-keystoneclient runs with the"},{"line_number":22,"context_line":"DEBUG log level enabled, a security weakness exposes sensitive data such"},{"line_number":23,"context_line":"as user passwords and tokens associated with requests/responses in log"}],"source_content_type":"application/octet-stream","patch_set":9,"id":"fa98f980_b323cd56","line":20,"updated":"2014-09-12 14:41:16.000000000","message":"no need to capitalize \"logger\"","commit_id":"3ea0ffdec7406bb707894297dfaf111a46afae78"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"881c515ea5ca91f92d746c8598459d33a4e21134","unresolved":false,"context_lines":[{"line_number":17,"context_line":"API requests to the OpenStack Identity Service, Keystone. It handles"},{"line_number":18,"context_line":"user sensitive data such as user password and tokens when sending "},{"line_number":19,"context_line":"requests or receiving responses from a Keystone server. Like all"},{"line_number":20,"context_line":"OpenStack projects, python-keystoneclient uses python Logger to log"},{"line_number":21,"context_line":"request/response activities. When python-keystoneclient runs with the"},{"line_number":22,"context_line":"DEBUG log level enabled, a security weakness exposes sensitive data such"},{"line_number":23,"context_line":"as user passwords and tokens associated with requests/responses in log"}],"source_content_type":"application/octet-stream","patch_set":9,"id":"fa98f980_6d306756","line":20,"in_reply_to":"fa98f980_b323cd56","updated":"2014-09-15 22:12:27.000000000","message":"+1.  You can just use lowercase \"logger\", or make it clear that you are referring to the class if that is your intention:\n\n  \"uses the python logging.Logger class to...\"\n\nFWIW, I see both of these types of usage in the Python docs:\n\n  https://docs.python.org/2/library/logging.html","commit_id":"3ea0ffdec7406bb707894297dfaf111a46afae78"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c63f313c4f71b8b0ed21ae08acf47192b15a3ea0","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Sensitive data exposure in log statements by python-keystoneclient"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"fa98f980_fb5c031c","line":1,"updated":"2014-09-16 12:07:24.000000000","message":"exposed?","commit_id":"3c6e7fcb45c4f1b15f75ff5272c8846392333e42"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c63f313c4f71b8b0ed21ae08acf47192b15a3ea0","unresolved":false,"context_lines":[{"line_number":15,"context_line":"### Discussion ###"},{"line_number":16,"context_line":"Python-keystoneclient provides an interface for making Identity API"},{"line_number":17,"context_line":"requests to the OpenStack Identity Service, Keystone."},{"line_number":18,"context_line":"Python-keystoneclient  handles user sensitive data such as user password"},{"line_number":19,"context_line":"and tokens when sending requests or receiving responses from a Keystone"},{"line_number":20,"context_line":"server. Like all OpenStack projects, python-keystoneclient uses python"},{"line_number":21,"context_line":"logger to log request/response activities. When python-keystoneclient"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"fa98f980_1b99c7d0","line":18,"updated":"2014-09-16 12:07:24.000000000","message":"double space","commit_id":"3c6e7fcb45c4f1b15f75ff5272c8846392333e42"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c63f313c4f71b8b0ed21ae08acf47192b15a3ea0","unresolved":false,"context_lines":[{"line_number":19,"context_line":"and tokens when sending requests or receiving responses from a Keystone"},{"line_number":20,"context_line":"server. Like all OpenStack projects, python-keystoneclient uses python"},{"line_number":21,"context_line":"logger to log request/response activities. When python-keystoneclient"},{"line_number":22,"context_line":"runs with the DEBUG log level enabled, a security weakness exposes"},{"line_number":23,"context_line":"sensitive data such as user passwords and tokens associated with"},{"line_number":24,"context_line":"requests/responses in log statements. For example:"},{"line_number":25,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":10,"id":"fa98f980_9b93f7a3","line":22,"updated":"2014-09-16 12:07:24.000000000","message":"Odd use of \"security weakness\". It\u0027s not an off by one or some other bug, it\u0027s a bad design decision, the program is running as the developer intended - they\u0027re just wrong.","commit_id":"3c6e7fcb45c4f1b15f75ff5272c8846392333e42"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c63f313c4f71b8b0ed21ae08acf47192b15a3ea0","unresolved":false,"context_lines":[{"line_number":46,"context_line":"Version 0.10.1 of python-keystoneclient has addressed this security"},{"line_number":47,"context_line":"weakness by not exposing user password and token information in log"},{"line_number":48,"context_line":"statements. Any service using version 0.10.1 of python-keystoneclient is"},{"line_number":49,"context_line":"not affected by this security weakness. Other services using old"},{"line_number":50,"context_line":"versions, should upgrade to a fixed version of python-keystoneclient."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"For a fresh installation of a service which depends on"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"fa98f980_fbe1632b","line":49,"updated":"2014-09-16 12:07:24.000000000","message":"Maybe avoid repeating \u0027security weakness\u0027 here - \u0027issue\u0027 would suffice.","commit_id":"3c6e7fcb45c4f1b15f75ff5272c8846392333e42"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"780ad81f6977c5aa70289e57622e4d8c22c6f58a","unresolved":false,"context_lines":[{"line_number":50,"context_line":"upgrade to a fixed version of python-keystoneclient."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"For a fresh installation of a service which depends on"},{"line_number":53,"context_line":"pythone-keystoneclient, make sure it uses version 0.10.1 of"},{"line_number":54,"context_line":"python-keystoneclient. One way to do this is to set a specific version"},{"line_number":55,"context_line":"in the requirments.txt file. For example, in Horizon, update"},{"line_number":56,"context_line":"horizon/requirements.txt file:"}],"source_content_type":"application/octet-stream","patch_set":11,"id":"fa98f980_f5782efa","line":53,"updated":"2014-09-19 11:52:29.000000000","message":"... at least version 0.10.1 ...","commit_id":"8758ff891f9665f19fa115f2c777a02e7332b03c"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"c38a6cbeb4c42aad5448d845491bfaf89b53eca9","unresolved":false,"context_lines":[{"line_number":19,"context_line":"and tokens when sending requests or receiving responses from a Keystone"},{"line_number":20,"context_line":"server. Like all OpenStack projects, python-keystoneclient uses python"},{"line_number":21,"context_line":"logger to log request/response activities. When python-keystoneclient"},{"line_number":22,"context_line":"runs with the DEBUG log level enabled, a security weakness exposes"},{"line_number":23,"context_line":"sensitive data such as user passwords and tokens associated with"},{"line_number":24,"context_line":"requests/responses in log statements. For example:"},{"line_number":25,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":12,"id":"da9df570_94c60648","line":22,"updated":"2014-09-24 13:18:03.000000000","message":"I don\u0027t really like the term \"security weakness\" here either.  Maybe just leave it off and say \"runs with the DEBUG log level enabled, sensitive data such as user passwords and tokens associated with requests/responses may be revealed in log statements.\"","commit_id":"e1f5b9ac1416d5c75e3cb101047e152568e3970b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"ca075710a6fe1c614ea863ed3d4b4f143e3ba613","unresolved":false,"context_lines":[{"line_number":19,"context_line":"and tokens when sending requests or receiving responses from a Keystone"},{"line_number":20,"context_line":"server. Like all OpenStack projects, python-keystoneclient uses python"},{"line_number":21,"context_line":"logger to log request/response activities. When python-keystoneclient"},{"line_number":22,"context_line":"runs with the DEBUG log level enabled, a security weakness exposes"},{"line_number":23,"context_line":"sensitive data such as user passwords and tokens associated with"},{"line_number":24,"context_line":"requests/responses in log statements. For example:"},{"line_number":25,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":12,"id":"da9df570_2e7262e5","line":22,"in_reply_to":"da9df570_94c60648","updated":"2014-09-24 15:06:06.000000000","message":"+1.  I think that this is worth changing (along with the other areas that refer to this as a \"security weakness\".","commit_id":"e1f5b9ac1416d5c75e3cb101047e152568e3970b"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"c38a6cbeb4c42aad5448d845491bfaf89b53eca9","unresolved":false,"context_lines":[{"line_number":43,"context_line":"respective services log statements."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"### Recommended Actions ###"},{"line_number":46,"context_line":"Version 0.10.1 of python-keystoneclient has addressed this security"},{"line_number":47,"context_line":"weakness by not exposing user password and token information in log"},{"line_number":48,"context_line":"statements. Any service using version 0.10.1 of python-keystoneclient is"},{"line_number":49,"context_line":"not affected by this issue. Other services using old versions, should"}],"source_content_type":"application/octet-stream","patch_set":12,"id":"da9df570_5403be72","line":46,"updated":"2014-09-24 13:18:03.000000000","message":"as Rob mentioned, it\u0027s not really a security weakness, it\u0027s kind of insecure by design. Maybe consider taking \"security weakness\" out here?  The sentence can stand alone without it.","commit_id":"e1f5b9ac1416d5c75e3cb101047e152568e3970b"}]}