PT-2019-6498 · Firegpg · Firegpg

Daniel Moerner · Publicado 2019-11-07 · Atualizado 2020-02-10 · CVE-2008-7272

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FireGPG versions prior to 0.6

Description The issue concerns the insecure handling of a user's passphrase and decrypted cleartext by FireGPG. Specifically, it writes pre-encrypted cleartext and the user's passphrase to disk, which may compromise secure communication or a user's private key.

Recommendations For FireGPG versions prior to 0.6, update to version 0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and avoiding the use of FireGPG for secure communication until the update is applied.

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2008-7272

Produtos afetados

Firegpg

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-7272 · Nota de Segurança
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514386 · Nota
• https://t.me/cibsecurity/8120 · Publicação no Telegram
• https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect · Nota
• https://t.me/cibsecurity/7993 · Publicação no Telegram
• https://security-tracker.debian.org/tracker/CVE-2008-7272 · Aviso do Fabricante