Vulnerability in Zx2c4 Password-Store
CVE-2020-28086
pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members' machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn't correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.006 (46.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 46th percentile — 46.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
Weakness classification (CWE)
References
- lists.zx2c4.com/pipermail/password-store/2014-March/000498.html (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-28086?
- CVE-2020-28086 is a high-severity vulnerability in Zx2c4 Password-Store, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.5/10. Published 2020-12-09.
- How severe is CVE-2020-28086?
- High severity. CVSS v3 base score is 7.5 out of 10.