{"issue":{"state":"closed","created_at":"2011-08-30T18:26:17Z","updated_at":"2011-11-22T11:46:15Z","comments":2,"user":{"gravatar_id":"7cee262d742938c32935ad38f43b8e40","id":133624,"url":"https://api.github.com/users/d1b","login":"d1b","avatar_url":"https://secure.gravatar.com/avatar/7cee262d742938c32935ad38f43b8e40?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"body":"It would appear that you will leak a user's api username, password when connecting  in console.py ---> as you pass the username and password as arguments to the ssh command via subprocess.Popen(). This means that any other user on the system can simply grep the output of ps -ef to learn the $victims username and password.\r\n\r\nThe \"leaky\" code is the following ---> \r\nproc = Popen(['ssh', '-qqt', '-oGlobalKnownHostsFile=%s' % hostfile.name, 'console@%s' % console_ip, \"%s %s %s\" % (api.user, vmname, api.pswd)])\r\n\r\n\r\n\r\n","assignee":null,"pull_request":{"patch_url":null,"html_url":null,"diff_url":null},"id":1523134,"number":2,"labels":[],"title":"console.py leaks api username and password to other user's ","html_url":"https://github.com/orionvm/ovm-ctl/issues/2","closed_at":"2011-11-21T11:04:21Z","url":"https://api.github.com/repos/orionvm/ovm-ctl/issues/2","milestone":null},"action":"created","comment":{"created_at":"2011-11-22T11:46:15Z","updated_at":"2011-11-22T11:46:15Z","user":{"gravatar_id":"7cee262d742938c32935ad38f43b8e40","id":133624,"url":"https://api.github.com/users/d1b","login":"d1b","avatar_url":"https://secure.gravatar.com/avatar/7cee262d742938c32935ad38f43b8e40?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"body":"Fair enough :-)","id":2833439,"url":"https://api.github.com/repos/orionvm/ovm-ctl/issues/comments/2833439"}}