Password Store

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:zx2c4:password-store:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorZx2C4 (55474c06-8c82-5431-908b-371f65883d85)
ProductPassword Store (be656d4c-d508-5d4f-8fbf-475a2ce0282a)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:deb/debian/password-store purl2cpe 2026-06-01 10:12:34.379476
pkg:deb/ubuntu/password-store purl2cpe 2026-06-01 10:12:34.379479
pkg:github/zx2c4/password-store purl2cpe 2026-06-01 10:12:34.379481
pkg:rpm/opensuse/password-store purl2cpe 2026-06-01 10:12:34.379484

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2020-28086 vulnerable 2026-06-08 05:23:53.763711 Details available
pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members' machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn't correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.
Published: 2020-12-09T18:09:51.000Z
Updated: 2024-08-04T16:33:57.479Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.