5
CVSSv2

CVE-2017-8296

Published: 27/04/2017 Updated: 03/10/2019
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password entries created and consulted are also accessible in cleartext.

Vulnerable Product Search on Vulmon Subscribe to Product

ked password manager project ked password manager 1.0

ked password manager project ked password manager 0.5

Vendor Advisories

Debian Bug report logs - #860817 kedpm: CVE-2017-8296: Information leak via the command history file Package: src:kedpm; Maintainer for src:kedpm is Antoine Beaupré <anarcat@debianorg>; Reported by: Gabriel Filion <gabster@lelutinca> Date: Thu, 20 Apr 2017 15:00:02 UTC Severity: grave Tags: patch, security, upstre ...