security: remove password after authenticating the user

fix https://nvd.nist.gov/vuln/detail/CVE-2021-28235 Signed-off-by: Benjamin Wang <wachao@vmware.com>
etcd-io · Apr 6, 2023 · c79e7b7 · c79e7b7
1 parent 6429dd4
commit c79e7b7
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/server/etcdserver/v3_server.go b/server/etcdserver/v3_server.go
@@ -445,6 +445,13 @@ func (s *EtcdServer) Authenticate(ctx context.Context, r *pb.AuthenticateRequest
 
 	lg := s.Logger()
 
+	// fix https://nvd.nist.gov/vuln/detail/CVE-2021-28235
+	defer func() {
+		if r != nil {
+			r.Password = ""
+		}
+	}()
+
 	var resp proto.Message
 	for {
 		checkedRevision, err := s.AuthStore().CheckPassword(r.Name, r.Password)