Credential disclosure via unhashed password update

Plaintext password storage in Netflix Lemur before 1.9.2 allows attackers to obtain usable credentials via admin password resets. lemur.users.service.update() assigns a replacement password directly to users.password, while User.hash_password is wired only to the before_insert SQLAlchemy event, so PUT /api/1/users/ stores the new value in cleartext on update. Reachability is limited to administrator-initiated password changes, but any later database, backup, replica, query-log, or administrative read exposure yields immediately reusable credentials, and the affected user can no longer authenticate normally.