PT-2007-6290 · Duplicity · Duplicity

Publicado 2007-10-04 · Atualizado 2022-05-01 · CVE-2007-5201

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Duplicity versions prior to 0.4.9

Description The issue concerns the FTP backend of Duplicity, where the password is sent as a command line argument when calling ncftp. This might allow local users to read the password by listing the process and its arguments.

Recommendations For versions prior to 0.4.9, update to version 0.4.9 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2007-5201

GHSA-WXCW-RQXC-HJ85

Produtos afetados

Duplicity

Referências · 16

• https://redhat.com/archives/fedora-package-announce/2008-February/msg00356.html · Aviso do Fabricante
• https://web.archive.org/web/20080118045107/https://duplicity.nongnu.org/CHANGELOG · Nota
• https://osv.dev/vulnerability/CVE-2007-5201 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wxcw-rqxc-hj85 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2007-5201 · Aviso do Fabricante
• http://osvdb.org/42339 · Nota
• https://web.archive.org/web/20200228164800/http://securityfocus.com/bid/27771 · Nota
• https://gitlab.com/duplicity/duplicity · Nota
• http://secunia.com/advisories/28917 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00445.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-5201 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-5201 · Aviso do Fabricante
• http://duplicity.nongnu.org/CHANGELOG · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=293081 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=442840 · Nota