HDS HNAS driver logs HNAS password as plain text

Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions.

Are does command log without DEBUG ?

No, the passwords are shown only when DEBUG is enabled.

I removed the OSSA task since DEBUG leak does not yield advisory.

Reviewed: https://review.openstack.org/219810
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=15755b8e9a5f8019e8d19b709b86d582d8b6e0c2
Submitter: Jenkins
Branch: master

commit 15755b8e9a5f8019e8d19b709b86d582d8b6e0c2
Author: Tiago Pasqualini <email address hidden>
Date: Wed Sep 2 14:58:03 2015 -0300

    Fix HDS HNAS driver logging password as plain text

    HDS HNAS driver logs every command that is sent to HNAS. Some
    commands need the HNAS password, so the driver ends up logging
    this password as plain text. This patch changes these commands
    syntax so that oslo_utils.strutils.mask_password can successfully
    mask this password.

    Change-Id: I720701d8ee2b944ad498917f668160894f1f07cc
    Closes-Bug: #1491524

Fix proposed to branch: stable/kilo
Review: https://review.openstack.org/221470

Fix proposed to branch: stable/kilo
Review: https://review.openstack.org/221922

Change abandoned by Tiago Pasqualini da Silva (<email address hidden>) on branch: stable/kilo
Review: https://review.openstack.org/221470
Reason: Could not change Change-Id for this patch, so I sent a new one.

Reviewed: https://review.openstack.org/221922
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=9314616cac732fb9ec2f1dfb879c98c614226909
Submitter: Jenkins
Branch: stable/kilo

commit 9314616cac732fb9ec2f1dfb879c98c614226909
Author: Tiago Pasqualini <email address hidden>
Date: Wed Sep 2 14:58:03 2015 -0300

    Fix HDS HNAS driver logging password as plain text

    HDS HNAS driver logs every command that is sent to HNAS. Some
    commands need the HNAS password, so the driver ends up logging
    this password as plain text. This patch changes these commands
    syntax so that oslo_utils.strutils.mask_password can successfully
    mask this password.

    Conflicts:
     cinder/volume/drivers/hds/hnas_backend.py

    Change-Id: I720701d8ee2b944ad498917f668160894f1f07cc
    Closes-Bug: #1491524
    (cherry picked from commit 15755b8e9a5f8019e8d19b709b86d582d8b6e0c2)

Fix proposed to branch: stable/juno
Review: https://review.openstack.org/222630

Reviewed: https://review.openstack.org/222630
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=7979f558a6d9eedcda6fee6cfbcc5eca93c4fc8c
Submitter: Jenkins
Branch: stable/juno

commit 7979f558a6d9eedcda6fee6cfbcc5eca93c4fc8c
Author: Tiago Pasqualini <email address hidden>
Date: Fri Sep 11 10:57:20 2015 -0300

    Fix HDS HNAS driver logging password as plain text

    HDS HNAS driver logs every command that is sent to HNAS. Some
    commands need the HNAS password, so the driver ends up logging
    this password as plain text. This patch changes these commands
    syntax so that oslo_utils.strutils.mask_password can successfully
    mask this password.

    Based on commit 15755b8e9a5f8019e8d19b709b86d582d8b6e0c2.
    Cherry-pick was not successful since the files are significantly
    different from master branch, so the changes were manually
    replicated on these files.

    Change-Id: I720701d8ee2b944ad498917f668160894f1f07cc
    Closes-Bug: #1491524