News

Warning Before Entering Personal Data When Submitting Bug Reports – Use of Config Report in ownCloud

According to a recent blog published by security specialist Hanno Boeck and to a report published in Golem, use of the bug report function on Github has resulted in the potential publication of passwords by different users. When you fill out a bug report with ownCloud, you are asked for the contents of your configuration […]

By ownCloud

ownCloud secure cloud solution for filesharing

According to a recent blog published by security specialist Hanno Boeck and to a report published in Golem, use of the bug report function on Github has resulted in the potential publication of passwords by different users. When you fill out a bug report with ownCloud, you are asked for the contents of your configuration file, and in several cases, this has resulted in the inadvertent reporting of safety-relevant information.

ownCloud is responding to this problem with a cleanup of all issuesm a weekly scan, as well as a clearer security warning, which warns against recording sensitive information in the report.

Additionaly we want to emphasise the graphic Config Report that is already in use for ownCloud customers. Since ownCloud 9.1.4 this is available for everybody.

Screenshot Config Report

Although the form already contained a warning to remove passwords or other relevant data before sending it, these inadvertent publications have increased, and the data has subsequently become publicly accessible to Github. Particularly critical are passwords for SMTP access to mail servers.

Intensive Monitoring and Clear Indications

Using the API provided by Github, the ownCloud developers have scanned all relevant issues and have explicitly scanned passwords included in the reports. Across all repositories, 553 passwords could be found and have been removed manually. To counteract the problem more proactively, the previously mentioned information that no sensitive data was entered was once again emphasized more clearly. In addition, ownCloud will perform the automated scan once a week from now on.

Salt Removed ownCloud

With the Config Report, which is available both graphically as ownCloud App, but also via the command line, there is a simple and comfortable way to provide the configuration of the system for the reporting of issues without issuing any security-relevant information. These are automatically removed.

Users who have completed bug reports are advised to make a precautionary change to their passwords. If you have any questions, you can contact your ownCloud Support at any time.

 

 

ownCloud

Aprile 21, 2017

Ready to see what’s next?

Having trouble viewing or submitting this form?

Contact Us

We care about protecting your data. Here’s our Privacy Policy.

Read now:

Nessun risultato

La pagina richiesta non è stata trovata. Affina la tua ricerca, o utilizza la barra di navigazione qui sopra per trovare il post.