11 lines
503 B
Diff
11 lines
503 B
Diff
# UNDF: UNDF-2026-000001140
|
|
--- a/src/client.c
|
|
+++ b/src/client.c
|
|
@@ -1121,7 +1121,7 @@ static bool scram_client_first(PgSocket *client, uint32_t datalen, const uint8_t
|
|
|
|
if (!user->mock_auth) {
|
|
- slog_debug(client, "stored secret = \"%s\"", user->passwd);
|
|
+ /* Do not log user->passwd: it holds the SCRAM verifier or plaintext password (CWE-312). */
|
|
switch (get_password_type(user->passwd)) {
|
|
case PASSWORD_TYPE_MD5:
|
|
slog_error(client, "SCRAM authentication failed: user has MD5 secret");
|