vulnwire
7.5high

CVE-2017-8296

kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext.

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.4%
percentile 72%
Public exploits
0
none known

kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password entries created and consulted are also accessible in cleartext.

Exploit prediction (EPSS)

1.38% probability of exploitation in the next 30 days, higher than 72% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-522 Insufficiently Protected Credentials

References

  • openwall.com /lists/oss-security/2017/04/26/9 · x_refsource_CONFIRM, x_transferred
  • sourceforge.net /p/kedpm/bugs/6/ · x_refsource_MISC, x_transferred
  • security.gentoo.org /glsa/201708-04 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • bugs.debian.org /cgi-bin/bugreport.cgi?bug=860817 · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.