[GEODE-9805] Debug logging of Radish AUTH command in ExecutionHandlerContext.executeCommand() reveals sensitive information

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.15.0
• Fix Version/s: 1.15.0
• Component/s: redis
• Labels: blocks-1.15.0​ pull-request-available unreleased
• Assignee: Donal Evans
• Reporter: Donal Evans
• Created: 08/Nov/21 23:22
• Updated: 22/Jun/22 20:46
• Resolved: 09/Nov/21 23:22

Description

With debug logging enabled, the ExecutionHandlerContext.executeCommand() method logs every command executed along with its arguments. In the case of the AUTH command, this results in un-redacted userId and/or password being logged, which represents a serious security issue.

Issue Links

• links to: GitHub Pull Request #7094