Bug 1906413 (CVE-2020-28086)

Summary: CVE-2020-28086 pass: has a possibility of using a password for an unintended resource
Product: [Other] Security Response Reporter: Michael Kaplan <mkaplan>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED UPSTREAM QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: carl, cfergeau, pingou
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-12-10 18:47:00 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1906415, 1906414    
Bug Blocks:    

Description Michael Kaplan 2020-12-10 13:28:21 UTC 
pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members' machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn't correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.

External References:

https://lists.zx2c4.com/pipermail/password-store/2014-March/000498.html
Comment 1 Michael Kaplan 2020-12-10 13:28:41 UTC 
Created pass tracking bugs for this issue:

Affects: fedora-all [bug 1906414]
Comment 2 Michael Kaplan 2020-12-10 13:29:43 UTC 
Created pass tracking bugs for this issue:

Affects: epel-8 [bug 1906415]
Comment 3 Product Security DevOps Team 2020-12-10 18:47:00 UTC 
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.