CVE-2020-28086 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	Medium
Remote	Yes
Type	Insufficient validation
Description	pass has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members' machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn't correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.

Group	Package	Affected	Fixed	Severity	Status	Ticket
AVG-1342	pass	1.7.4-1		Medium	Vulnerable

References
https://lists.zx2c4.com/pipermail/password-store/2014-March/000555.html

Notes
Workaround ========== This issue can be mitigated by signing all commits and using git pull --verify-signatures to make sure changes to the Git repository are signed by a valid key. To automatically sign all commits created by pass, the following command can be used: pass git config --bool --add pass.signcommits true

Notes

Workaround
==========

This issue can be mitigated by signing all commits and using git pull --verify-signatures to make sure changes to the Git repository are signed by a valid key. To automatically sign all commits created by pass, the following command can be used:

pass git config --bool --add pass.signcommits true