GitHub Advisoryadvisory · PyPI

GHSA-wxcw-rqxc-hj85 FTP backend for Duplicity Discloses Passwords to Process Listing

MEDIUM Published 2022-05-01 Modified 2023-09-22 Official page ↗
Aliases
CVE-2007-5201
Ecosystem
PyPI
Packages
duplicity
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2023-09-22

Affected packages

• PyPI duplicity: < 0.4.9 → fixed in 0.4.9

Description

The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.

Related

Alias · CVE (1)

  • CVE-2007-5201 The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References