Re: [pear-webmaster] PEAR site email

--Sig_/AxwSSr0l4TpA2CFodgBumoT
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hello Matthew,


> Over the last couple of months I've started receiving a weird email
> that appears to be from the PEAR site.  The subject of the message
> "Password for PEAR bug report #4623" and it's sent from
> [email protected].  The entire (redacted) body of the email is:
>=20
>> The password for PEAR bug report #4623 is [redacted].
>
> Any thoughts on what's going on here?

The pear bug database allows unregistered users to submit bugs and
attach a password to the bug report, so that they can edit the
bug later by supplying the password.

Those user passwords were indeed stored in plaintext in the database.

I've purged all the user bug passwords now, which means that no further
bug-password-lost mails will be sent out.

The mails stemmed from someone accessing bugs/bug-pwd-finder.php with
all bug IDs I guess.


--=20
Regards/Mit freundlichen Gr=C3=BC=C3=9Fen
Christian Weiske

-=3D=E2=89=A1 Geeking around in the name of science since 1982 =E2=89=A1=3D-

--Sig_/AxwSSr0l4TpA2CFodgBumoT
Content-Type: application/pgp-signature; name=signature.asc
Content-Disposition: attachment; filename=signature.asc

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAloR//kACgkQFMhaCCTq+CNzPgCgvmSC/8a/ZnHG7+VdgT17CjG/
DpEAniqq2GSAAj0P602rqD6wHNXjG5o/
=3RZJ
-----END PGP SIGNATURE-----

--Sig_/AxwSSr0l4TpA2CFodgBumoT--