CVE-2007-5201
FTP backend for Duplicity Discloses Passwords to Process Listing
The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.
Exploit likelihood
What each source reports
NVD Score used
The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.
- Record
CVE-2007-5201- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.
- Record
CVE-2007-5201- Updated
- 2026-11-02
EUVDEUVD-2022-5669 No score
The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.
- Record
EUVD-2022-5669- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wxcw-rqxc-hj85 No score
FTP backend for Duplicity Discloses Passwords to Process Listing
The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.
- Record
GHSA-wxcw-rqxc-hj85- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.
- Record
CVE-2007-5201- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-5201 No score
The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.
- Record
DEBIAN-CVE-2007-5201- Updated
- 2026-11-02
OSVGHSA-wxcw-rqxc-hj85 No score
FTP backend for Duplicity Discloses Passwords to Process Listing
The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.
- Record
GHSA-wxcw-rqxc-hj85- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVPYSEC-2026-633 No score
FTP backend for Duplicity Discloses Passwords to Process Listing
The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.
- Record
PYSEC-2026-633- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-5201 is a medium vulnerability (CVSS 4.6) in Duplicity Project Duplicity, published October 4, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in duplicity 0.4.9.
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=442840
securityfocus.com/bid/27771
redhat.com/archives/fedora-package-announce/2008-February/msg00356.html
bugzilla.redhat.com/show_bug.cgi?id=293081
secunia.com/advisories/28917
duplicity.nongnu.org/CHANGELOG
Show 9 moreShow less
osvdb.org/42339
nvd.nist.gov/vuln/detail/CVE-2007-5201
web.archive.org/web/20080118045107/https://duplicity.nongnu.org/CHANGELOG
github.com/advisories/GHSA-wxcw-rqxc-hj85
security-tracker.debian.org/tracker/CVE-2007-5201
gitlab.com/duplicity/duplicity
pypi.org/project/duplicity