aws-samples / aws-samples/aws-secrets-manager-ssh-key-rotation
Ineffective security measure in copy_file.py
- Dominant language
- Python
- Stars
- 64
- Forks
- 24
- PR merge metrics
- No merged PRs in 30d
Description
This line of code is intended to purge the secret from memory:
https://github.com/aws-samples/aws-secrets-manager-ssh-key-rotation/blob/163b90fd217a7ce9285d700bca8afe87a0f181b3/scripts/copy_file.py#L65
Unfortunately, it does not: python strings are immutable, and reassignment of a string variable in python allocates a new buffer, leaving the old buffer in memory as garbage. Thus the best practices being espoused here are not actually being adhered to.
I verified this using a similar approach to [this nice blog post](https://www.sjoerdlangkemper.nl/2016/06/09/clearing-memory-in-python/):
```
$ echo 'import os; x="verysecret"; x="###############"; del x; os.abort()' > test.py
$ ulimit -c unlimited
$ python3 test.py
Aborted (core dumped)
$ grep verysecret core
Binary file core matches
```
Thus this string would remain in RAM until the same address happens to be used again later.
The [AWS blog post](https://aws.amazon.com/blogs/security/how-to-use-aws-secrets-manager-securely-store-rotate-ssh-key-pairs/) accompanying this repository wrote:
> details about keeping secret data in volatile memory will follow later in this post.
...but no such details seemed to be forthcoming.
Contributor guide
Research direction
Start with scripts/copy_file.py at the linked line 65 and reproduce the memory-retention behavior using the issue's Python example. Review the accompanying AWS blog post and determine a supported way to handle the secret without relying on immutable-string reassignment; done means the ineffective security measure is removed or replaced and the behavior is verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100