[GUACAMOLE-1162] security in guacamole_user_attribute

• Type: Improvement
• Status: Closed
• Priority: Trivial
• Resolution: Duplicate
• Affects Version/s: 1.2.0
• Component/s: guacamole-auth-jdbc-mysql
• Labels: security
• Environment: any
• Flags: Patch, Important
• Assignee: Unassigned
• Reporter: jean louis abegg
• Created: 28/Aug/20 15:00
• Updated: 28/Aug/20 15:09
• Resolved: 28/Aug/20 15:09

Description

Hello,

I've backuped a guacamole install 1.2.0 and sniffed in the .sql file.

In the table guacamole_user_attribute, i've seen clear password in it.

A suggestion would be to encrypt the parameter_value when parameter_name is equal to "password"

Unless i'ts already done in 1.3.0?

Thank you for your hard work.

Issue Links

• duplicates: GUACAMOLE-641 Support storage of sensitive data within key vaults