CVE-2017-8296 json
kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext.
published 2017-04-27 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-17258
- cvss
- 7.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 72%
- public exploits
- 0
- none known
Summary
kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password entries created and consulted are also accessible in cleartext.
Patch / fix
Exploit prediction
1.38% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-522 Insufficiently Protected Credentials
References
-
sourceforge.net
/p/kedpm/bugs/6/
issue-tracking, patch, third-party-advisory
-
bugs.debian.org
/cgi-bin/bugreport.cgi?bug=860817
issue-tracking, patch
-
security.gentoo.org
/glsa/201708-04
vendor-advisory
-
openwall.com
/lists/oss-security/2017/04/26/9
mailing-list, third-party-advisory
Sources
- CVE List CVE-2017-8296
- NVD CVE-2017-8296
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.