password-changes visible in /var/log/messages

[Moritz Molle <mmolle@gmx.net>]

If I do

# grep change_password /var/log/messages

I get a list of passwords, if the users have changed their given 
passwords. That must not be the case. It's a serious security issue, and 
is not solved by /var/log/messages only be readable for root.

How can i turn off logging of cleartext-passwords?

thank you

M. Molle