https://bugs.exim.org/show_bug.cgi?id=1666
Bug ID: 1666
Summary: exim should log unexpanded queries
Product: Exim
Version: 4.86
Hardware: x86
OS: Linux
Status: NEW
Severity: bug
Priority: medium
Component: Logging
Assignee: nigel@???
Reporter: arekm@???
CC: exim-dev@???
If you use authenticator query like this:
server_condition = ${lookup mysql{SELECT .... WHERE
ENCRYPT('${quote_mysql:$auth2}')...}
then in case of sql db problems exim will happily log expanded query revealing
auth2 in plain text for example. Depending on user queries such logging my
reveal many things.
Like:
2015-08-03 10:21:36 login authenticator failed for ...: 435 Unable to
authenticate at present ...: lookup of "SELECT
...ENCRYPT('my-secret-pass-1234'...gave DEFER: MYSQL connection failed: Access
denied for user ...
That's quite bad. Exim while logging should log unexpanded sql query if
possible to never reveal such data.
--
You are receiving this mail because:
You are on the CC list for the bug.
