Db.addUser() appears in shell history, with cleartext passwords - MongoDB(jira.mongodb.org)
jira.mongodb.org
Db.addUser() appears in shell history, with cleartext passwords - MongoDB
https://jira.mongodb.org/browse/SERVER-3768
4 comments
I tested some stuff with MongoDB about a month ago and I did notice the shell-history-thing with addUser at that time.
Edit: It is not fixed in 2.0.2 at least. (Tested now)
Edit: It is not fixed in 2.0.2 at least. (Tested now)
Edit: Looks like it's available only in the local user history of the machine you perform the addUser.
So I guess the risk is low.
So I guess the risk is low.
MySQL has had this same problem forever. This isn't something "new". Its stored in the local users .mysql_history
Thanks for bringing this to our attention. It has just been fixed in master.
[deleted]
Has it been fixed? What is the implications of having it in the console history?