IBM Storage Scale management GUI (deploy and upgrade logging): The Storage Scale admin password is written in the clear

Impact

The Storage Scale admin password is written in the clear into GUI logs, so anyone who can read those logs - including support bundle recipients - gets the credential that controls the storage management plane.

Who can reach it

Local read access to GUI log files on a Storage Scale 5.2.3.0-5.2.3.8 or 6.0.0.0-6.0.1.0 management node, or possession of any support snap collected from one.

What to do

Apply the fix from IBM's bulletin, then rotate the admin password, purge the affected log files, and recall or destroy any support bundles already sent off site.

References