Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Master key should not be input with env or args #106

Closed
zhongguozhang opened this issue Nov 1, 2018 · 3 comments
Closed

Master key should not be input with env or args #106

zhongguozhang opened this issue Nov 1, 2018 · 3 comments
Labels
vuln Vulnerability

Comments

@zhongguozhang
Copy link

查看自己的钱包余额时,如果之前有输入master key,则提示失败。

错误提示如下:

./cql -config conf/config.yaml -get-balance

ERRO[0000] decrypt private key error caller="privatekeystore.go:50 crypto/kms.LoadPrivateKey"

INFO[0000] load private key failed: invalid PKCS#7 padding caller="privatekeystore.go:90 crypto/kms.InitLocalKeyPair"

ERRO[0000] unexpected error while loading private key: invalid PKCS#7 padding caller="privatekeystore.go:109 crypto/kms.InitLocalKeyPair"

ERRO[0000] init covenantsql client failed: invalid PKCS#7 padding caller="main.go:196 main.main"

@auxten auxten added the vuln Vulnerability label Nov 2, 2018
@auxten
Copy link
Contributor

auxten commented Nov 2, 2018

You can try -password to pass a master key.
This is vulnerable and will be changed to use an interactive way to let user input master key in the console.

@zhongguozhang
Copy link
Author

测过了, ./cql -config conf/config.yaml -get-balance -password xxxxxx 这样可以

@auxten auxten changed the title 查看自己的钱包余额时,如果之前有输入master key,则提示失败。 Master key should not be input with env or args Nov 4, 2018
@auxten
Copy link
Contributor

auxten commented Mar 28, 2019

Fixed at #284

@auxten auxten closed this as completed Mar 28, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
vuln Vulnerability
Projects
None yet
Development

No branches or pull requests

2 participants