Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 573
Alerts This Week
Warning Icon 1 573

Gentoo: 202303-01 Critical: XYZ Password Manager Security Breach

gentoo
Calendar Grey August 21, 2017
Dist Gentoo Esm H88
Ked Password Tool on Gentoo Linux exhibits a vulnerability leading to data exposure caused by improper file handling. Prompt removal is recommended.
An insecure file usage has been reported in Ked Password Manager possibly allowing confidential information to be disclosed.

Summary

A history file in ~/.kedpm/history is written in clear text. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password entries created and consulted are also accessible in clear text.

Topics%20covered

Topics Covered

security advisory information leak gentoo normal severity password manager

Resolution

Gentoo Security recommends that users unmerge Ked Password Manager: # emerge --unmerge "app-admin/kedpm"

References

[ 1 ] CVE-2017-8296 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-8296

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201708-04
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity
critical
Lowest
Low
Medium
High
Critical

Severity: Normal
Title: Ked Password Manager: Information leak
Date: August 21, 2017
Bugs: #616690
ID: 201708-04

Topics%20covered

Topics Covered

security advisory information leak gentoo normal severity password manager

Synopsis

An insecure file usage has been reported in Ked Password Manager possibly allowing confidential information to be disclosed.

Background

Helps to manage large numbers of passwords and related information and simplifies the tasks of searching and entering password data.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-admin/kedpm < 0.4.0-r2 Vulnerable! ------------------------------------------------------------------- NOTE: Certain packages are still vulnerable. Users should migrate to another package if one is available or wait for the existing packages to be marked stable by their architecture maintainers.

Impact

===== An attacker could obtain confidential information.

Workaround

There is no known workaround at this time.