CVE-2019-19022: Infoleak
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git repositories.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19022?
CVE-2019-19022 has been classified as a low severity vulnerability due to the potential exposure of search history.
How do I fix CVE-2019-19022?
To mitigate the risk associated with CVE-2019-19022, users should upgrade iTerm2 to version 3.3.7 or later.
What is the impact of CVE-2019-19022?
CVE-2019-19022 may allow remote attackers to access sensitive information through search history documented in the plist file.
Which versions of iTerm2 are affected by CVE-2019-19022?
iTerm2 versions up to and including 3.3.6 are affected by CVE-2019-19022.
What type of information could be exposed due to CVE-2019-19022?
CVE-2019-19022 could expose sensitive search history information stored in the com.googlecode.iterm2.plist file.