CVE-2020-28086 Other in n/a
Attackers can trick users into decrypting and sending wrong passwords by renaming files in the Git repository, bypassing integrity checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-28086?
CVE-2020-28086 is a high-severity vulnerability in n/a, published on 9 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members' machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn't correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.
Weakness: CWE-347
Which versions are affected by CVE-2020-28086?
It affects 1 product.
Products include Zx2c4 Password-Store.
How do I fix CVE-2020-28086?
No fix has been published for CVE-2020-28086 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-28086 being exploited?
There is no known exploitation of CVE-2020-28086 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2020-28086, GHSA-phjf-vhjh-qv5p, UBUNTU-CVE-2020-28086.