CVE-2017-8296
kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of...
kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password entries created and consulted are also accessible in cleartext.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password entries created and consulted are also accessible in cleartext.
- Record
CVE-2017-8296- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
CVE List No score
kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password entries created and consulted are also accessible in cleartext.
- Record
CVE-2017-8296- Updated
- 2026-11-02
EUVDEUVD-2017-17258 No score
kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password entries created and consulted are also accessible in cleartext.
- Record
EUVD-2017-17258- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-54h8-8vv6-353m
kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of...
kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password entries created and consulted are also accessible in cleartext.
- Record
GHSA-54h8-8vv6-353m- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-8296
kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password entries created and consulted are also accessible in cleartext.
- Record
UBUNTU-CVE-2017-8296- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-8296 is a high vulnerability (CVSS 7.5) in Ked Password Manager Project Password Manager, published April 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in kedpm 0.5.0-4+deb7u1.
References
openwall.com/lists/oss-security/2017/04/26/9
sourceforge.net/p/kedpm/bugs/6
security.gentoo.org/glsa/201708-04
bugs.debian.org/cgi-bin/bugreport.cgi?bug=860817
nvd.nist.gov/vuln/detail/CVE-2017-8296
github.com/advisories/GHSA-54h8-8vv6-353m
ubuntu.com/security/CVE-2017-8296
openwall.com/lists/oss-security/2017/04/25/9
cve.org/CVERecord?id=CVE-2017-8296