CVE Vulnerabilities

CVE-2020-28086

Improper Verification of Cryptographic Signature

Published: Dec 09, 2020 | Modified: Jul 21, 2021
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu
LOW

pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesnt correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.

Weakness

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected Software

Name Vendor Start Version End Version
Password-store Zx2c4 * 1.7.3 (including)
Password-store Ubuntu bionic *
Password-store Ubuntu groovy *
Password-store Ubuntu hirsute *
Password-store Ubuntu impish *
Password-store Ubuntu kinetic *
Password-store Ubuntu lunar *
Password-store Ubuntu mantic *
Password-store Ubuntu trusty *
Password-store Ubuntu xenial *

References