Your message dated Fri, 28 Apr 2017 08:20:19 +0000
with message-id <e1d418v-00068h...@fasolo.debian.org>
and subject line Bug#861277: Removed package(s) from unstable
has caused the Debian Bug report #860817,
regarding kedpm: CVE-2017-8296: Information leak via the command history file
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
860817: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860817
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: kedpm
Version: 1.0
Severity: grave
Tags: upstream security
Justification: user security hole
Hello,
I've discovered an information leak that can give some hints about what ppl
search and read in the password manager.
kedpm is creating a history file in ~/.kedpm/history that is written in clear
text. All of the commands that are done in the password manager are writted
there.
This also means that if someone uses the "password" command with the password
as an argument to change the database's master password, the new password gets
leaked in plaintext to that file!
The issue was already reported upstream[0]. However, the upstream project seems
to be unmoving since a couple of years already.
[0]: https://sourceforge.net/p/kedpm/bugs/6/
I've discovered the bug in wheezy, so in 0.5.0 but the same problem applies to
later releases.
-- System Information:
Debian Release: 9.0
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 4.9.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_CA.utf8, LC_CTYPE=en_CA.utf8 (charmap=UTF-8) (ignored: LC_ALL
set to en_CA.utf8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
--- End Message ---
--- Begin Message ---
Version: 1.0+rm
Dear submitter,
as the package kedpm has just been removed from the Debian archive
unstable we hereby close the associated bug reports. We are sorry
that we couldn't deal with your issue properly.
For details on the removal, please see https://bugs.debian.org/861277
The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.
This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmas...@ftp-master.debian.org.
Debian distribution maintenance software
pp.
Chris Lamb (the ftpmaster behind the curtain)
--- End Message ---
