PT-2017-18266 · Kedpm · Kedpm

Lelutin · Published 2017-04-27 · Updated 2019-10-03 · CVE-2017-8296

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions kedpm versions 0.5 through 1.0

Description The issue allows for the disclosure of sensitive information, including the master password, due to the storage of command history in cleartext. This affects the confidentiality of password entries and their names.

Recommendations For versions 0.5 through 1.0, consider removing or securing the history file located at ~/.kedpm/history to prevent unauthorized access to sensitive information. As a temporary workaround, avoid using the password command with an argument that could expose the master password. Restrict access to the history file to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2017-8296

DLA-925-1

Affected Products

Kedpm

References · 10

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860817 · Patch
• https://ubuntu.com/security/CVE-2017-8296 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-8296 · Vendor Advisory
• https://security.gentoo.org/glsa/201708-04 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8296 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-8296 · Security Note
• https://sourceforge.net/p/kedpm/bugs/6 · Patch
• http://openwall.com/lists/oss-security/2017/04/26/9 · Note
• http://openwall.com/lists/oss-security/2017/04/25/9 · Note