BUG #16449: Log file and the query field of the pg_stat_statements table display clear text password.

From: PG Bug reporting form <noreply(at)postgresql(dot)org>
To: pgsql-bugs(at)lists(dot)postgresql(dot)org
Cc: abcxiaod(at)126(dot)com
Subject: BUG #16449: Log file and the query field of the pg_stat_statements table display clear text password.
Date: 2020-05-18 09:16:31
Message-ID: 16449-4d45c7092ac52797@postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

The following bug has been logged on the website:

Bug reference: 16449
Logged by: yi Ding
Email address: abcxiaod(at)126(dot)com
PostgreSQL version: 10.12
Operating system: linux
Description:

1、The log_statement is set to ALL
2、Execute statement:alter user t password 'adsf123asg';
3、Log file shows clear text password.

2020-05-18 10:32:11.606
CST,"postgres","postgres",16959,"[local]",5ec1f354.423f,3,"",2020-05-18
10:30:44 CST,14/26972,0,LOG,00000,"statement: alter user t password
'adsf123asg';",,,,,,,,"exec_simple_query, postgres.c:963","psql"

4、The query field of the pg_stat_statements table displays the clear text
of the password.

postgres=# select * from pg_stat_statements where queryid = '2555618481';
-[ RECORD 1 ]-------+-----------------------------------
userid | 10
dbid | 12298
queryid | 2555618481
query | alter user t password 'adsf123asg'
calls | 2
total_time | 0.266986
min_time | 0.127103
max_time | 0.139883
mean_time | 0.133493
stddev_time | 0.00639000000000001
rows | 0
shared_blks_hit | 6
shared_blks_read | 0
shared_blks_dirtied | 2
shared_blks_written | 0
local_blks_hit | 0
local_blks_read | 0
local_blks_dirtied | 0
local_blks_written | 0
temp_blks_read | 0
temp_blks_written | 0
blk_read_time | 0
blk_write_time | 0

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message PG Bug reporting form 2020-05-18 09:17:07 BUG #16450: Recovery.conf file shows clear text password.
Previous Message PG Bug reporting form 2020-05-18 09:14:49 BUG #16448: Remote code execution vulnerability