| From: | David Rowley <dgrowleyml(at)gmail(dot)com> |
|---|---|
| To: | bkindrajeeth(at)gmail(dot)com, pgsql-bugs(at)lists(dot)postgresql(dot)org |
| Subject: | Re: BUG #18817: Security Bug Report: Plaintext Password Exposure in Logs |
| Date: | 2025-02-18 12:21:04 |
| Message-ID: | CAApHDvoCnaLeVO4zdCaYJFBfcuGXYz1W5L917p526nWEcs=gqg@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
On Tue, 18 Feb 2025 at 22:51, PG Bug reporting form
<noreply(at)postgresql(dot)org> wrote:
> During the integration of PostgreSQL Database v15 logs into a SIEM
> solution,I observed that user passwords are logged in plaintext when a user
> is created using the database command. This poses a serious security risk as
> credentials could be exposed to unauthorized users who have access to the
> logs.
> Steps to Reproduce:
> CREATE USER indrajeet WITH PASSWORD 'indrajeet'
There's some relevant discussion about this in [1], in particular, see [2].
David
[1] https://www.postgresql.org/message-id/flat/CALNJ-vRQB81F9Q9V%2BoDPsCTF-%2B0o_xR3%3D7_GAZfyg2sEaEfQJA%40mail.gmail.com#1f62ceb364243164a3d3a41530db055f
[2] https://www.postgresql.org/message-id/1250706.1658622457%40sss.pgh.pa.us
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Indrajeeth Deshmukh | 2025-02-18 12:52:36 | Re: BUG #18817: Security Bug Report: Plaintext Password Exposure in Logs |
| Previous Message | Virender Singla | 2025-02-18 09:08:17 | PG17 --transaction-size=1000 caused MVU failure |