CVE-2018-12356
Critical
Description
An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extension scripts. Modifying the configuration file allows the attacker to inject additional encryption keys under their control, thereby disclosing passwords to the attacker. Modifying the extension scripts allows the attacker arbitrary code execution.
SeverityCritical
CVSS9.8
Exploit probability—
ProductSimple Password Store
PublishedJun 15, 2018
First seenJun 15, 2018
How to fix
Update
- simple_password_store_project simple_password_store1.7.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simple_password_store_project simple_password_store | 1.7.0 ≤ v < 1.7.2 | 1.7.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.