From 2613b66dfdf08c1715d5b475ac7bd84b764ca04d Mon Sep 17 00:00:00 2001 From: tuanaiseo Date: Tue, 7 Apr 2026 06:20:04 +0700 Subject: [PATCH] fix(security): sensitive secret material is echoed in error outpu On decryption failure, the script logs the full encrypted sudo password blob in stderr (`Error decrypting password "..."`). Even encrypted secrets should be treated as sensitive since they can be harvested from logs and reused for offline analysis or correlation attacks. Affected files: sudo_askpass.py Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com> --- bbot/core/helpers/depsinstaller/sudo_askpass.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bbot/core/helpers/depsinstaller/sudo_askpass.py b/bbot/core/helpers/depsinstaller/sudo_askpass.py index ccd8cd01b6..69454bb631 100644 --- a/bbot/core/helpers/depsinstaller/sudo_askpass.py +++ b/bbot/core/helpers/depsinstaller/sudo_askpass.py @@ -33,7 +33,7 @@ def main(): decrypted_password = decrypt_password(encrypted_password, key) print(decrypted_password, end="") except Exception as e: - print(f'Error decrypting password "{encrypted_password}": {str(e)}', file=sys.stderr) + print(f"Error decrypting sudo password: {str(e)}", file=sys.stderr) sys.exit(1)