GHSA-2p6r-x3vv-xqm2: rpassword affected by partial password reveal when input is interrupted
rpassword maintainers were made aware of a possible issue with a partial password reveal when input is interrupted.
To quote @squell:
@conradkleinespel I’ve confirmed this problem with SequoiaPGP, which I think uses rpassword, e.g.:
Suppose we use pkill -9 sq in a different terminal right after the password has been typed in:
$ sq key generate –userid “barf” –with-password Enter password to protect the key: Killed $ hello^C
Where the password I typed in is “hello”.
This has been fixed in version v7.5.0 and above.
References
Code Behaviors & Features
Detect and mitigate GHSA-2p6r-x3vv-xqm2 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →