CVE-2020-1774 Information disclosure
Attackers can accidentally receive private keys instead of public keys due to identical filenames, leading to sensitive data exposure in OTRS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-1774?
CVE-2020-1774 is a medium-severity vulnerability in Debian Debian Linux, published on 28 Apr 2020. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects ((OTRS)) Community Edition: 5.0.42 and prior versions, 6.0.27 and prior versions. OTRS: 7.0.16 and prior versions.
Weakness: CWE-201
Which versions are affected by CVE-2020-1774?
It affects 2 products.
Products include Debian Debian Linux, Otrs Otrs.
How do I fix CVE-2020-1774?
Upgrade to a fixed version.
Is CVE-2020-1774 being exploited?
There is no known exploitation of CVE-2020-1774 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2020-1774, GHSA-5g6p-jp4c-37q4, UBUNTU-CVE-2020-1774.