PT-2018-11141 · Simple Password Store+1 · Pass+1

Marcus Brinkmann · Published 2018-06-15 · Updated 2021-07-03 · CVE-2018-12356

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pass versions 1.7.x through 1.7.1

Description An issue in the password-store.sh script of Simple Password Store allows remote attackers to spoof file signatures on configuration files and extension scripts due to an incomplete regular expression in the signature verification routine. This can lead to the disclosure of passwords if an attacker modifies the configuration file to inject additional encryption keys. Furthermore, modifying the extension scripts can allow the attacker to execute arbitrary code.

Recommendations For pass versions 1.7.x through 1.7.1, update to version 1.7.2 or later to resolve the issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

ALT-PU-2021-2135

CVE-2018-12356

OPENSUSE-SU-2024:11150-1

Affected Products

Alt Linux

Pass

References · 16

• https://ubuntu.com/security/CVE-2018-12356 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-12356 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12356 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-12356 · Security Note
• https://git.zx2c4.com/password-store/commit/?id=8683403b77f59c56fcb1f05c61ab33b9fd61a30d · Patch
• https://security-tracker.debian.org/tracker/CVE-2018-12356 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12356 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12356 · Vendor Advisory
• https://github.com/RUB-NDS/Johnny-You-Are-Fired · Note
• https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf · Note
• http://openwall.com/lists/oss-security/2019/04/30/4 · Note
• http://openwall.com/lists/oss-security/2018/06/14/3 · Note
• https://neopg.io/blog/pass-signature-spoof · Note
• http://seclists.org/fulldisclosure/2019/Apr/38 · Note
• http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html · Note