VulnerabilityModified

CVE-2007-5201

The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.

MEDIUM 4.6EPSS 0.37%

Does this matter?

Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 4.6 MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
EPSS: 0.37% probability · 31th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: duplicity project/duplicity
Source: cve@mitre.org

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=442840Third Party Advisory
http://duplicity.nongnu.org/CHANGELOGBroken Link
http://osvdb.org/42339Broken Link
http://secunia.com/advisories/28917Third Party Advisory
http://www.securityfocus.com/bid/27771Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=293081Issue Tracking, Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00356.htmlThird Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00445.htmlThird Party Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=442840Third Party Advisory
http://duplicity.nongnu.org/CHANGELOGBroken Link
http://osvdb.org/42339Broken Link
http://secunia.com/advisories/28917Third Party Advisory
http://www.securityfocus.com/bid/27771Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=293081Issue Tracking, Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00356.htmlThird Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00445.htmlThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.