summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAaron Bauman <bman@gentoo.org>2017-08-20 20:08:22 -0400
committerAaron Bauman <bman@gentoo.org>2017-08-20 20:08:22 -0400
commit95b7f71954b7374b74e9722bad380e473c46ab19 (patch)
tree5963c2b6816a31e268538842c6e4fcc1d1f505db
parentRevert "Add GLSA 201708-03" (diff)
downloadglsa-master.zip
glsa-master.tar.gz
glsa-master.tar.bz2
Add GLSA 201708-04HEADmaster
-rw-r--r--glsa-201708-04.xml49
1 files changed, 49 insertions, 0 deletions
diff --git a/glsa-201708-04.xml b/glsa-201708-04.xml
new file mode 100644
index 0000000..09bf5c4
--- /dev/null
+++ b/glsa-201708-04.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201708-04">
+ <title>Ked Password Manager: Information leak</title>
+ <synopsis>An insecure file usage has been reported in Ked Password Manager
+ possibly allowing confidential information to be disclosed.
+ </synopsis>
+ <product type="ebuild">kedpm</product>
+ <announced>2017-08-21</announced>
+ <revised>2017-08-21: 1</revised>
+ <bug>616690</bug>
+ <access>local, remote</access>
+ <affected>
+ <package name="app-admin/kedpm" auto="yes" arch="*">
+ <vulnerable range="lt">0.4.0-r2</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>Helps to manage large numbers of passwords and related information and
+ simplifies the tasks of searching and entering password data.
+ </p>
+ </background>
+ <description>
+ <p>A history file in ~/.kedpm/history is written in clear text. All of the
+ commands performed in the password manager are written there. This can
+ lead to the disclosure of the master password if the “password”
+ command is used with an argument. The names of the password entries
+ created and consulted are also accessible in clear text.
+ </p>
+ </description>
+ <impact type="normal">
+ <p>An attacker could obtain confidential information.</p>
+ </impact>
+ <workaround>
+ <p>There is no known workaround at this time.</p>
+ </workaround>
+ <resolution>
+ <p>Gentoo Security recommends that users unmerge Ked Password Manager:</p>
+
+ <code>
+ # emerge --unmerge "app-admin/kedpm"
+ </code>
+ </resolution>
+ <references>
+ <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-8296">CVE-2017-8296</uri>
+ </references>
+ <metadata tag="requester" timestamp="2017-08-14T23:18:50Z">b-man</metadata>
+ <metadata tag="submitter" timestamp="2017-08-21T00:06:05Z">b-man</metadata>
+</glsa>