[ZEPPELIN-2733] Remove System Information Leak in Authentication.java

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 0.7.3, 0.8.0
• Component/s: security
• Assignee: Yanbo Liang
• Reporter: Yanbo Liang
• Created: 06/Jul/17 06:30
• Updated: 16/Aug/17 00:24
• Resolved: 10/Jul/17 04:05

Description

An information leak occurs when system data or debugging information leaves the program through an output stream or logging function.
In the file Authentication.java,

Line 137: LOG.debug("Encrypted user key is {}", userKey);
Line 148: LOG.debug("IV is {}, IV length is {}", initVector, initVector.length());

These lines may print information which can reveal some important data to user making it vulnerable to attacks, we should not log this sensitive information.

Issue Links

• Blocked: ZEPPELIN-2864 Release 0.7.3
• links to: GitHub Pull Request #2468