PT-2014-1789 · Debian · Parcimonie

Published 2014-02-14 · Updated 2017-08-29 · CVE-2014-1921

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions parcimonie versions prior to 0.8.1

Description The issue concerns multiple vulnerabilities in the parcimonie package of the Debian GNU/Linux operating system. These vulnerabilities can be exploited remotely, potentially leading to breaches in confidentiality, integrity, and availability of protected information. Specifically, when using a large keyring, parcimonie sleeps for the same amount of time between fetches, allowing attackers to correlate key fetches via unspecified vectors.

Recommendations For versions prior to 0.8.1, update to version 0.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the keyring or limiting the use of large keyrings to minimize the risk of exploitation.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2015-04122

CVE-2014-1921

DSA-2860-1

Affected Products

Parcimonie

References · 14

• https://osv.dev/vulnerability/CVE-2014-1921 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-1921 · Vendor Advisory
• http://debian.org/security/2014/dsa-2860 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1921 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-1921 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-1921 · Vendor Advisory
• https://gaffer.ptitcanardnoir.org/intrigeri/files/parcimonie/App-Parcimonie-0.8.1.tar.gz · Patch
• https://bdu.fstec.ru/vul/2015-04122 · Security Note
• http://seclists.org/oss-sec/2014/q1/308 · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738134 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91118 · Note
• http://seclists.org/oss-sec/2014/q1/305 · Note
• http://debian.org/security/dsa-2860 · Note
• http://securityfocus.com/bid/65505 · Note