CVE-2019-7306
Byobu apport hook uploads user's ~/.screenrc
Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Byobu apport hook uploads user's ~/.screenrc
Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu
- Record
CVE-2019-7306- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
EUVDEUVD-2019-16850
Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu
- Record
EUVD-2019-16850- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2rpx-jj49-wf29 No score
Byobu Apport hook may disclose sensitive information since it automatically uploads the local...
Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu
- Record
GHSA-2rpx-jj49-wf29- Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu
- Record
CVE-2019-7306- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-552
- Updated
- 2026-11-02
OSV
Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu
- Record
CVE-2019-7306- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-7306
Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu
- Record
DEBIAN-CVE-2019-7306- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-7306
Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu
- Record
UBUNTU-CVE-2019-7306- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUSN-5234-1 No score
byobu vulnerability
Sander Bos discovered that Byobu incorrectly handled certain Apport data. An attacker could possibly use this issue to expose sensitive information.
- Record
USN-5234-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
byobuDebian:12 |
All versions, plus listed versions 5.133-1.15.133-1.27.13-17.15-17.18-17.19-1 |
None known |
byobuDebian:13 |
All versions, plus listed versions 5.133-1.15.133-1.27.13-17.15-17.18-17.19-1 |
None known |
byobuDebian:14 |
All versions, plus listed versions 5.133-1.15.133-1.27.13-17.15-17.18-17.19-1 |
None known |
byobuUbuntu:14.04:LTS |
All versions, plus listed versions 5.60-0ubuntu15.62-0ubuntu15.63-0ubuntu15.64-0ubuntu15.65-0ubuntu1 Show 12 moreShow less5.66-0ubuntu15.67-0ubuntu15.69-0ubuntu15.70-0ubuntu15.71-0ubuntu15.72-0ubuntu15.73-0ubuntu15.74-0ubuntu15.75-0ubuntu15.76-0ubuntu15.77-0ubuntu15.77-0ubuntu1.2 |
None known |
byobuUbuntu:Pro:16.04:LTS |
before 5.106-0ubuntu1+esm1, plus listed versions 5.97-0ubuntu15.98-0ubuntu15.99-0ubuntu15.99-0ubuntu25.100-0ubuntu1 Show 6 moreShow less5.101-0ubuntu15.102-0ubuntu15.103-0ubuntu15.104-0ubuntu15.105-0ubuntu15.106-0ubuntu1 |
5.106-0ubuntu1+esm1 |
byobuUbuntu:18.04:LTS |
All versions, plus listed versions 5.123-0ubuntu15.123-0ubuntu25.124-0ubuntu15.125-0ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-7306 is a medium vulnerability (CVSS 4.3) in Byobu, published April 17, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.77%, the 78th percentile. Fixed in byobu 5.106-0ubuntu1+esm1.
References
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7306
bugs.launchpad.net/ubuntu/+source/byobu/+bug/1827202
nvd.nist.gov/vuln/detail/CVE-2019-7306
github.com/advisories/GHSA-2rpx-jj49-wf29
security-tracker.debian.org/tracker/CVE-2019-7306
ubuntu.com/security/CVE-2019-7306
cve.org/CVERecord?id=CVE-2019-7306