CVE-2017-8296 Information disclosure in n/a
The password manager stores command history in cleartext, potentially exposing the master password and entry names to local attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-8296?
CVE-2017-8296 is a high-severity vulnerability in n/a, published on 27 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password entries created and consulted are also accessible in cleartext.
Weakness: CWE-522
Which versions are affected by CVE-2017-8296?
It affects 1 product.
Products include Ked Password Manager Project Ked Password Manager.
How do I fix CVE-2017-8296?
Apply the vendor's patch.
Is CVE-2017-8296 being exploited?
There is no known exploitation of CVE-2017-8296 in the wild and no public exploit code.
Sources
Also known as DLA-925-1, GHSA-54h8-8vv6-353m, UBUNTU-CVE-2017-8296.