Python package "zhmcclient" stores passwords in clear text in its HMC and API logs

ImpactThe Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: The 'boot-ftp-password' and 'ssc-master-pw' properties when creating or updating a partition in DPM mode, in the zhmcclient API and HMC logs The 'ssc-master-pw' an...

Cleartext Storage of Sensitive Information

Overview zhmcclient is an A pure Python client library for the IBM Z HMC Web Services API Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information due to the logging of sensitive information in clear text. An attacker with access to the logs can obtain...