[ZOOKEEPER-2405] getTGT() in Login.java mishandles confidential information

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 3.4.8, 3.5.1, 3.6.0
• Fix Version/s: 3.4.9, 3.5.2, 3.6.0
• Component/s: kerberos, security, server
• Hadoop Flags: Reviewed
• Assignee: Michael Han
• Reporter: Patrick D. Hunt
• Created: 26/Mar/16 19:04
• Updated: 21/Jul/16 20:18
• Resolved: 25/May/16 20:47

Description

We're logging the kerberos ticket when in debug mode, probably not the best idea. This was identified as a "critical" issue by Fortify.

        for(KerberosTicket ticket: tickets) {
            KerberosPrincipal server = ticket.getServer();
            if (server.getName().equals("krbtgt/" + server.getRealm() + "@" + server.getRealm())) {
                LOG.debug("Found tgt " + ticket + ".");
                return ticket;
            }
        }