Db.addUser() appears in shell history, with cleartext passwords - MongoDB

by tbassetto • 14 years ago

26 5 14 years ago

mrspeaker• 14 years ago

This was reported on Sep 06 2011... a suggested fix in the ticket was "should strip from history like .auth()".

Has it been fixed? What is the implications of having it in the console history?

hjalle• 14 years ago

I tested some stuff with MongoDB about a month ago and I did notice the shell-history-thing with addUser at that time.

Edit: It is not fixed in 2.0.2 at least. (Tested now)

jye• 14 years ago

Edit: Looks like it's available only in the local user history of the machine you perform the addUser.

So I guess the risk is low.

thspimpolds• 14 years ago

MySQL has had this same problem forever. This isn't something "new". Its stored in the local users .mysql_history

mathias_10gen• 14 years ago

Thanks for bringing this to our attention. It has just been fixed in master.

Related Stories