CVE-2020-10256: Critical severity 1password command-line vulnerability
An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge prior to 0.7.3. An insecure random number generator was used to generate various keys. An attacker with access to the user's encrypted data may be able to perform brute-force calculations of encryption keys and thus succeed at decryption.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-10256?
CVE-2020-10256 has been classified as a medium severity vulnerability due to its potential impact on the security of encrypted data.
How do I fix CVE-2020-10256?
To fix CVE-2020-10256, update the 1Password command-line tool to version 0.5.5 or later and the SCIM bridge to version 0.7.3 or later.
What causes the vulnerability in CVE-2020-10256?
CVE-2020-10256 is caused by the use of an insecure random number generator in certain versions of 1Password products.
Who is affected by CVE-2020-10256?
Users of beta versions of the 1Password command-line tool prior to 0.5.5 and the SCIM bridge prior to 0.7.3 are affected by CVE-2020-10256.
Can an attacker exploit CVE-2020-10256 remotely?
An attacker cannot exploit CVE-2020-10256 remotely, but they need access to the user's encrypted data to take advantage of the vulnerability.