PT-2019-6498 · Firegpg · Firegpg

Daniel Moerner · Published 2019-11-07 · Updated 2020-02-10 · CVE-2008-7272

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FireGPG versions prior to 0.6

Description The issue concerns the insecure handling of a user's passphrase and decrypted cleartext by FireGPG. Specifically, it writes pre-encrypted cleartext and the user's passphrase to disk, which may compromise secure communication or a user's private key.

Recommendations For FireGPG versions prior to 0.6, update to version 0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and avoiding the use of FireGPG for secure communication until the update is applied.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2008-7272

Affected Products

Firegpg

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-7272 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2008-7272 · Vendor Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514386 · Note
• https://t.me/cibsecurity/8120 · Telegram Post
• https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect · Note
• https://t.me/cibsecurity/7993 · Telegram Post