PasswordUtils blanks out the password causing the AuthKeyboardInteractive to always fail
- Dominant language
- Java
- Stars
- 2.7k
- Forks
- 620
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 11
Description
The `authPassword` method takes the same instance of the `PasswordFinder` into both `AuthMethod`. If for some reason the first `AuthMethod` fails (`password` method in this case, e.g. not an accepted method on the host) and it then attempts to authenticate via the `keyboard-interactive` method, the password would have been cleared out after it was retrieved on the first attempt causing the second attempt to always fail.
My current workaround is to create both `AuthMethod` with separate instances of `PasswordFinder` with the same password and that works for me, but I'm assuming the password is being cleared for security reasons? Creating 2 instances of the password and potentially only using the first once will leave the second instance potentially exploitable. Not sure how you would like to address this issue.
https://github.com/hierynomus/sshj/blob/45b2f32b148e06201a028b9480a98249b6c3b446/src/main/java/net/schmizz/sshj/SSHClient.java#L286-L289
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.