An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extension scripts. Modifying the configuration file allows the attacker to inject additional encryption keys under their control, thereby disclosing passwords to the attacker. Modifying the extension scripts allows the attacker arbitrary code execution.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The     signature verification routine parses the output of GnuPG with an incomplete regular expression, which     allows remote attackers to spoof file signatures on configuration files and extension scripts. Modifying     the configuration file allows the attacker to inject additional encryption keys under their control,     thereby disclosing passwords to the attacker. Modifying the extension scripts allows the attacker     arbitrary code execution. (CVE-2018-12356)

Note that Nessus relies on the presence of the package as reported by the vendor.

Update to new upstream release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jason A. Donenfeld reports :

Markus Brinkmann discovered that [the] parsing of gpg command line output with regexes isn't anchored to the beginning of the line, which means an attacker can generate a malicious key that simply has the verification string as part of its username.

This has a number of nasty consequences :

- an attacker who manages to write into your ~/.password-store and also inject a malicious key into your keyring can replace your .gpg-id key and have your passwords encrypted under additional keys;

- if you have extensions enabled (disabled by default), an attacker who manages to write into your ~/.password-store and also inject a malicious key into your keyring can replace your extensions and hence execute code.

ID	Name	Product	Family	Severity
254254	Linux Distros Unpatched Vulnerability : CVE-2018-12356	Nessus	Misc.	critical
120691	Fedora 28 : pass (2018-a89844963c)	Nessus	Fedora Local Security Checks	critical
110669	Fedora 27 : pass (2018-a3e631b454)	Nessus	Fedora Local Security Checks	critical
110540	FreeBSD : password-store -- GPG parsing vulnerabilities (53eb9e1e-7014-11e8-8b1f-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2018-12356

critical

Tenable Plugins

critical

critical

critical

critical