GCVE - cpe:2.3:a:simple_password_store_project:simple_password

Approved changes feed: RSS · Atom

cpe:2.3:a:simple_password_store_project:simple_password_store:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Simple Password Store Project (`8c894f23-004b-5112-bd9c-57c6cfbe8e37`)
Product	Simple Password Store (`60875927-e9ec-5a80-ac89-58f88d215c6f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2018-12356`	vulnerable	2026-06-08 05:10:41.391236	Details available An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extension scripts. Modifying the configuration file allows the attacker to inject additional encryption keys under their control, thereby disclosing passwords to the attacker. Modifying the extension scripts allows the attacker arbitrary code execution. Published: 2018-06-15T02:00:00.000Z Updated: 2024-08-05T08:30:59.776Z Open on db.gcve.eu Reference links https://git.zx2c4.com/password-store/commit/?id=8683403b77f59c56fcb1f05c61ab33b9fd61a30d http://openwall.com/lists/oss-security/2018/06/14/3 https://lists.zx2c4.com/pipermail/password-store/2018-June/003308.html http://www.openwall.com/lists/oss-security/2019/04/30/4 http://seclists.org/fulldisclosure/2019/Apr/38	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.