PT-2017-18266 · Kedpm · Kedpm

Lelutin · Publicado 2017-04-27 · Atualizado 2019-10-03 · CVE-2017-8296

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions kedpm versions 0.5 through 1.0

Description The issue allows for the disclosure of sensitive information, including the master password, due to the storage of command history in cleartext. This affects the confidentiality of password entries and their names.

Recommendations For versions 0.5 through 1.0, consider removing or securing the history file located at ~/.kedpm/history to prevent unauthorized access to sensitive information. As a temporary workaround, avoid using the password command with an argument that could expose the master password. Restrict access to the history file to minimize the risk of exploitation.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2017-8296

DLA-925-1

Produtos afetados

Kedpm

Referências · 10

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860817 · Correção
• http://openwall.com/lists/oss-security/2017/04/26/9 · Nota
• https://ubuntu.com/security/CVE-2017-8296 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-8296 · Aviso do Fabricante
• https://security.gentoo.org/glsa/201708-04 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-8296 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8296 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2017-8296 · Nota de Segurança
• https://sourceforge.net/p/kedpm/bugs/6 · Correção
• http://openwall.com/lists/oss-security/2017/04/25/9 · Nota