{"id":"CVE-2019-7306","aliases":["DEBIAN-CVE-2019-7306","EUVD-2019-16850","GHSA-2rpx-jj49-wf29","UBUNTU-CVE-2019-7306","USN-5234-1"],"status":"published","title":"Byobu apport hook uploads user's ~/.screenrc","description":"Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01773,"percentile":0.7831,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-552"],"published":"2020-04-17T01:45:14Z","modified":"2026-09-21T07:01:21Z","fixes":[{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"byobu","fixed_in":["5.106-0ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"byobu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.133-1.1","5.133-1.2","7.13-1","7.15-1","7.18-1","7.19-1"]},{"source":"osv","ecosystem":"Debian:13","package":"byobu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.133-1.1","5.133-1.2","7.13-1","7.15-1","7.18-1","7.19-1"]},{"source":"osv","ecosystem":"Debian:14","package":"byobu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.133-1.1","5.133-1.2","7.13-1","7.15-1","7.18-1","7.19-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"byobu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.60-0ubuntu1","5.62-0ubuntu1","5.63-0ubuntu1","5.64-0ubuntu1","5.65-0ubuntu1","5.66-0ubuntu1","5.67-0ubuntu1","5.69-0ubuntu1","5.70-0ubuntu1","5.71-0ubuntu1","5.72-0ubuntu1","5.73-0ubuntu1","5.74-0ubuntu1","5.75-0ubuntu1","5.76-0ubuntu1","5.77-0ubuntu1","5.77-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"byobu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.106-0ubuntu1+esm1"}]}],"versions":["5.97-0ubuntu1","5.98-0ubuntu1","5.99-0ubuntu1","5.99-0ubuntu2","5.100-0ubuntu1","5.101-0ubuntu1","5.102-0ubuntu1","5.103-0ubuntu1","5.104-0ubuntu1","5.105-0ubuntu1","5.106-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"byobu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.123-0ubuntu1","5.123-0ubuntu2","5.124-0ubuntu1","5.125-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"byobu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.106-0ubuntu1+esm1"}]}],"versions":["5.97-0ubuntu1","5.98-0ubuntu1","5.99-0ubuntu1","5.99-0ubuntu2","5.100-0ubuntu1","5.101-0ubuntu1","5.102-0ubuntu1","5.103-0ubuntu1","5.104-0ubuntu1","5.105-0ubuntu1","5.106-0ubuntu1"]}],"products":[{"vendor":"byobu","product":"byobu"},{"vendor":"canonical","product":"byobu"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"friendsofflarum","product":"byobu"}],"references":[{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7306","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/byobu/+bug/1827202","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7306"},{"url":"https://github.com/advisories/GHSA-2rpx-jj49-wf29"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-7306","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-7306","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5234-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7306","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-7306","title":"Byobu apport hook uploads user's ~/.screenrc","description":"Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu","status":"published","published":"2020-04-17T01:45:14.788Z","modified":"2024-09-17T02:42:21.021Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:32:22.432545Z"}],"euvd":[{"id":"EUVD-2019-16850","description":"Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu","status":"published","published":"2020-04-17T01:45:14Z","modified":"2024-09-17T02:42:21Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:38.264635Z"}],"ghsa":[{"id":"GHSA-2rpx-jj49-wf29","title":"Byobu Apport hook may disclose sensitive information since it automatically uploads the local...","description":"Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu","status":"published","published":"2022-05-24T17:15:40Z","modified":"2023-01-29T05:02:14Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:45:02.058324Z"}],"nvd":[{"id":"CVE-2019-7306","description":"Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu","status":"published","published":"2020-04-17T02:15:11.547Z","modified":"2026-06-17T02:40:25.447Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:05:46.451008Z"}],"osv":[{"id":"CVE-2019-7306","description":"Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu","status":"published","published":"2020-04-17T02:15:11.547Z","modified":"2026-03-14T09:37:33.312391Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"DEBIAN-CVE-2019-7306","description":"Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu","status":"published","published":"2020-04-17T02:15:11.547Z","modified":"2026-09-21T07:01:21.470648158Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"UBUNTU-CVE-2019-7306","description":"Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu","status":"published","published":"2020-04-17T02:15:00Z","modified":"2026-02-04T02:47:57.15823Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"USN-5234-1","title":"byobu vulnerability","description":"Sander Bos discovered that Byobu incorrectly handled certain Apport data.\nAn attacker could possibly use this issue to expose sensitive information.\n","status":"published","published":"2022-01-18T18:29:24Z","modified":"2026-06-25T13:30:56.498789672Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}