{"id":"GHSA-2p6r-x3vv-xqm2","aliases":[],"status":"published","title":"rpassword affected by partial password reveal when input is interrupted","description":"rpassword maintainers were made aware of a possible issue with a partial password reveal when input is interrupted.\n\nTo quote @squell:\n\n\u003e @conradkleinespel I've confirmed this problem with SequoiaPGP, which I think uses rpassword, e.g.:\n\u003e\n\u003e Suppose we use pkill -9 sq in a different terminal right after the password has been typed in:\n\u003e\n\u003e $ sq key generate --userid \"barf\" --with-password\n\u003e Enter password to protect the key: Killed\n\u003e $ hello^C\n\u003e\n\u003e Where the password I typed in is \"hello\".\n\nThis has been fixed in version v7.5.0 and above.","severity":{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-755"],"published":"2026-05-06T21:49:33Z","modified":"2026-09-10T03:51:04Z","fixes":[{"ecosystem":"crates.io","package":"rpassword","fixed_in":["7.5.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"rpassword","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"7.4.0"},{"fixed":"7.5.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rpassword","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.5.0"}]}]}],"references":[{"url":"https://github.com/conradkleinespel/rpassword/security/advisories/GHSA-2p6r-x3vv-xqm2","tags":["web"]},{"url":"https://github.com/conradkleinespel/rpassword/releases/tag/v7.5.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2p6r-x3vv-xqm2"},{"url":"https://github.com/conradkleinespel/rpassword","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-2p6r-x3vv-xqm2","title":"rpassword affected by partial password reveal when input is interrupted ","description":"rpassword maintainers were made aware of a possible issue with a partial password reveal when input is interrupted.\n\nTo quote @squell:\n\n\u003e @conradkleinespel I've confirmed this problem with SequoiaPGP, which I think uses rpassword, e.g.:\n\u003e\n\u003e Suppose we use pkill -9 sq in a different terminal right after the password has been typed in:\n\u003e\n\u003e $ sq key generate --userid \"barf\" --with-password\n\u003e Enter password to protect the key: Killed\n\u003e $ hello^C\n\u003e\n\u003e Where the password I typed in is \"hello\".\n\nThis has been fixed in version v7.5.0 and above.","status":"published","published":"2026-05-06T21:49:33Z","modified":"2026-05-06T21:49:34Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"low"}],"cwes":["CWE-200","CWE-755"],"updated_at":"2026-11-02T14:40:02.883746Z"}],"osv":[{"id":"GHSA-2p6r-x3vv-xqm2","title":"rpassword affected by partial password reveal when input is interrupted ","description":"rpassword maintainers were made aware of a possible issue with a partial password reveal when input is interrupted.\n\nTo quote @squell:\n\n\u003e @conradkleinespel I've confirmed this problem with SequoiaPGP, which I think uses rpassword, e.g.:\n\u003e\n\u003e Suppose we use pkill -9 sq in a different terminal right after the password has been typed in:\n\u003e\n\u003e $ sq key generate --userid \"barf\" --with-password\n\u003e Enter password to protect the key: Killed\n\u003e $ hello^C\n\u003e\n\u003e Where the password I typed in is \"hello\".\n\nThis has been fixed in version v7.5.0 and above.","status":"published","published":"2026-05-06T21:49:33Z","modified":"2026-09-10T03:51:04.143649116Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"low"}],"cwes":["CWE-200","CWE-755"],"updated_at":"2026-11-02T15:46:34.700741Z"}]}}