Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2020-28086: Password-Store may send decrypted password to wrong service
CVE-2020-28086 · published 5 years ago
Summary
Version 1.7.3 of the password-store program can decrypt a password file even when the file name does not match its contents. If an attacker can change files on the central Git server, they can rename a password file so a user decrypts the wrong password and sends it to the attacker’s service. Using signed Git commits or upgrading to a newer version stops this from happening.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | password-store | All versions |
| Debian:13 | debian | password-store | All versions |
| Debian:14 | debian | password-store | All versions |
| – | zx2c4 | password-store |
<= 1.7.3 cpe:2.3:a:zx2c4:password-store:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | password-store | All versions |
Original advisory text
pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with t...
pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members' machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn't correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.
References
- https://lists.zx2c4.com/pipermail/password-store/2014-March/000498.html Third Party Advisory
- https://ubuntu.com/security/CVE-2020-28086 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-28086 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2020-28086 Vendor Advisory
Severity
7.5
High
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published9 Dec 2020
Updated4 Nov 2026
First seen11 Sep 2026
Track software like this
Free during beta