From cfafbab668d174714fefd86d70907a089f62395b Mon Sep 17 00:00:00 2001 From: "Nelson, Thomas (tn1381)" Date: Tue, 4 Jun 2019 12:49:02 -0400 Subject: Fix vulnerability in code where password is being exposed in logs. Issue-ID: MUSIC-406 Signed-off-by: Nelson, Thomas (tn1381) Change-Id: I5af16bf25a967ae27875b8c42cf746c3fa857a27 --- jar/pom.xml | 3 ++- jar/src/main/java/org/onap/music/main/CachingUtil.java | 2 +- jar/src/main/java/org/onap/music/main/MusicUtil.java | 6 ++---- jar/version.properties | 2 +- 4 files changed, 6 insertions(+), 7 deletions(-) diff --git a/jar/pom.xml b/jar/pom.xml index 03b1ef3a..c4e4294f 100755 --- a/jar/pom.xml +++ b/jar/pom.xml @@ -25,7 +25,7 @@ org.onap.music MUSIC jar - 2.5.8 + 2.5.9 This is the MUSIC REST interface, packaged as a war file. @@ -44,6 +44,7 @@ 2.0.1 3.4.0 3.4.11 + https://nexus.onap.org UTF-8 UTF-8 diff --git a/jar/src/main/java/org/onap/music/main/CachingUtil.java b/jar/src/main/java/org/onap/music/main/CachingUtil.java index f0dc06fc..4b293bbb 100755 --- a/jar/src/main/java/org/onap/music/main/CachingUtil.java +++ b/jar/src/main/java/org/onap/music/main/CachingUtil.java @@ -319,7 +319,7 @@ public class CachingUtil implements Runnable { Map resultMap = new HashMap<>(); if (ns == null || userId == null || password == null) { logger.error(EELFLoggerDelegate.errorLogger,"", AppMessages.MISSINGINFO ,ErrorSeverity.WARN, ErrorTypes.AUTHENTICATIONERROR); - logger.error(EELFLoggerDelegate.errorLogger,"One or more required headers is missing. userId: "+userId+" :: password: "+password); + logger.error(EELFLoggerDelegate.errorLogger,"One or more required headers is missing."); resultMap.put("Exception", "One or more required headers appName(ns), userId, password is missing. Please check."); return resultMap; diff --git a/jar/src/main/java/org/onap/music/main/MusicUtil.java b/jar/src/main/java/org/onap/music/main/MusicUtil.java index c36da9d7..686b0d04 100755 --- a/jar/src/main/java/org/onap/music/main/MusicUtil.java +++ b/jar/src/main/java/org/onap/music/main/MusicUtil.java @@ -569,12 +569,10 @@ public class MusicUtil { } String cassPwd = prop.getProperty("cassandra.password"); String isEncrypted = prop.getProperty("cassandra.password.isencrypted"); - logger.info(EELFLoggerDelegate.applicationLogger,"cassandra.password:" + cassPwd); - logger.info(EELFLoggerDelegate.applicationLogger,"cassandra.password.isencrypted:" + isEncrypted); if("true".equals(isEncrypted)) { - logger.info(EELFLoggerDelegate.applicationLogger,"Decrypting...."); + logger.debug(EELFLoggerDelegate.applicationLogger,"Decrypting...."); cassPwd = CipherUtil.decryptPKC(cassPwd); - logger.info(EELFLoggerDelegate.applicationLogger,"Decrypted password: "+cassPwd); + logger.debug(EELFLoggerDelegate.applicationLogger,"Password Decrypted"); MusicUtil.setCassPwd(cassPwd); } else MusicUtil.setCassPwd(cassPwd); diff --git a/jar/version.properties b/jar/version.properties index 2ffa6347..fbd855ff 100644 --- a/jar/version.properties +++ b/jar/version.properties @@ -4,7 +4,7 @@ major=2 minor=5 -patch=6 +patch=9 base_version=${major}.${minor}.${patch} -- cgit 1.2.3-korg