do these error messages leak secrets?

Bug #1881225 reported by Seth Arnold
256
This bug affects 1 person
Affects Status Importance Assigned to Milestone
juju-core (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

Hello, a coworker pasted this error message:

https://pastebin.canonical.com/p/pnNx7Rsfyr/

which appears to include a hex-encoded version of user-data supplied to a cloud guest that failed to launch:

 juju list-machines
Machine State DNS Inst id Series AZ Message
23 down 10.xx.xx.xx xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx bionic nova failed to start machine 23 (cannot run instance: failed to run a server with nova.RunServerOpts{Name:"juju-b11c42-ubuntu-23", FlavorId:"xxxxxxxx-xxxxxx-xxxxxxx-xxxxxxxxxxxx", ImageId:"xxxxxxxx-xxxxxx-xxxxxxx-xxxxxxxxxxxx", UserData:[]uint8{0x1f, 0x8b, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff,
...

The UserData field is quite long and looks like it can contain plaintext passwords:
- https://cloudinit.readthedocs.io/en/latest/topics/modules.html#set-passwords
- https://cloudinit.readthedocs.io/en/latest/topics/modules.html#apt-configure
- https://cloudinit.readthedocs.io/en/latest/topics/modules.html#lxd
- https://cloudinit.readthedocs.io/en/latest/topics/modules.html#redhat-subscription

or access tokens:
- https://cloudinit.readthedocs.io/en/latest/topics/modules.html#redhat-subscription
- https://cloudinit.readthedocs.io/en/latest/topics/modules.html#landscape

Is this error message only available to people who could read the supplied user data through another mechanism?

Can the secrets be elided from the user data before it's printed to logs or output for user consumption?

Thanks

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Hi, is anyone from the juju team looking into this?

Changed in juju-core (Ubuntu):
status: New → Confirmed
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.