PT-2020-12009 · 1Password · 1Password Scim Bridge+1

Published 2020-10-27 · Updated 2024-03-25 · CVE-2020-10256

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 1Password command-line tool versions prior to 0.5.5 1Password SCIM bridge versions prior to 0.7.3

Description An issue was discovered where an insecure random number generator was used to generate various keys. This could allow an attacker with access to the user's encrypted data to perform brute-force calculations of encryption keys, potentially succeeding at decryption.

Recommendations For 1Password command-line tool versions prior to 0.5.5, update to version 0.5.5 or later. For 1Password SCIM bridge versions prior to 0.7.3, update to version 0.7.3 or later.

Fix

Related Identifiers

CVE-2020-10256

Affected Products

1Password Scim Bridge

1Password Command-Line Tool

References · 7

• https://support.1password.com/kb/202010 · Vendor Advisory
• https://support.1password.com/command-line · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10256 · Security Note
• https://support.1password.com/scim · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10256 · Vendor Advisory
• https://t.me/cvenotify/74596 · Telegram Post
• https://t.me/cibsecurity/15611 · Telegram Post