Bug 1906413 (CVE-2020-28086) - CVE-2020-28086 pass: has a possibility of using a password for an unintended resource
Summary: CVE-2020-28086 pass: has a possibility of using a password for an unintended ...
Keywords:
Status: CLOSED UPSTREAM
Alias: CVE-2020-28086
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1906414 1906415
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-12-10 13:28 UTC by Michael Kaplan
Modified: 2021-02-16 18:45 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-12-10 18:47:00 UTC


Attachments (Terms of Use)

Description Michael Kaplan 2020-12-10 13:28:21 UTC
pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members' machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn't correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.

External References:

https://lists.zx2c4.com/pipermail/password-store/2014-March/000498.html

Comment 1 Michael Kaplan 2020-12-10 13:28:41 UTC
Created pass tracking bugs for this issue:

Affects: fedora-all [bug 1906414]

Comment 2 Michael Kaplan 2020-12-10 13:29:43 UTC
Created pass tracking bugs for this issue:

Affects: epel-8 [bug 1906415]

Comment 3 Product Security DevOps Team 2020-12-10 18:47:00 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.


Note You need to log in before you can comment on or make changes to this bug.