search

jenkins-x-plugins / jx-gitops

a simple CLI tool for working with kubernetes resources files in a GitOps repository
Apache License 2.0
33 stars 50 forks source link

Leak: the chart registry password is shown in clear text on step-promote-helm-release error #545

Open hervelemeur opened 3 years ago

hervelemeur commented 3 years ago

On the first release of a PHP quickstart, I've got this error where I saw the credentials for the helm chart repo in clear text:

Showing logs for build my-org-php-test-master-2 stage pipeline and container step-promote-helm-release     releasing chart php-test    error: failed to create chart release in dir charts/php-test: failed to publish: failed to run 'curl --fail -sS -u admin:\ --data-binary @php-test-0.0.1.tgz http://jenkins-x-chartmuseum.jx.svc.cluster.local:8080/api/charts' command in directory 'charts/php-test', output: 'curl: (22) The requested URL returned error: 409 Conflict'

brandongottesman-taulia commented 1 year ago

Almost 2 years since this was open and still experiencing this security vulnerability.

falsedlah commented 1 year ago

@msvticket any plan to fix this