CVE-2022-0725: Infoleak
First published: Wed Feb 09 2022(Updated: )
A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Keepass Keepass | =2.48 | |
| Fedoraproject Extra Packages For Enterprise Linux | =7.0 | |
| Fedoraproject Fedora | =35 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=2052696
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2053688
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2053691
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2053689
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2053692
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2053693
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2053690
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1899751
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1899751&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1899865
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1899865&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1891592
- https://sourceforge.net/p/keepass/discussion/329220/thread/33d6afdc/
- https://src.fedoraproject.org/rpms/keepassxc
- https://sourceforge.net/p/keepass/discussion/329220/thread/da7546b7e1/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2052696#c22
- https://access.redhat.com/security/cve/CVE-2022-0725
- https://keepass.info/help/kb/sec_issues.html#fdslog
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2052696#c26
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2052696#c16
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2052696#c29
- https://keepass.info/download.html
- https://src.fedoraproject.org/rpms/keepass/blob/1425aa4b6f1e1f52bb9166aec3886498d57387de/f/keepass.spec#_30
- https://keepass.info/filepool/KeePass_230525.zip
- https://vergenet.net/~conrad/software/xsel/
- https://github.com/kfish/xsel
- https://github.com/kfish/xsel/commit/79748acf3045546a4d8ae444de99bb7a07d16eb7
- https://src.fedoraproject.org/rpms/xsel/tree/rawhide
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2052696#c23
- https://www.reddit.com/r/KeePass/comments/uwbh1t/locally_syncing_open_keepassxc_database_between/
- https://pagure.io/releng/issue/11793
- https://docs.fedoraproject.org/en-US/package-maintainers/Package_Review_Process/
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2022-0725.
What is the severity of CVE-2022-0725?
The severity of CVE-2022-0725 is high with a CVSS score of 7.5.
How does this vulnerability occur?
This vulnerability occurs due to logging the plain text passwords in the system log.
What is the impact of CVE-2022-0725?
CVE-2022-0725 can lead to an Information Exposure vulnerability, allowing an attacker to interact and read sensitive passwords and logs.
Are there any known references for CVE-2022-0725?
Yes, there are references available at: [Link 1](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2053688), [Link 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2053691), and [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2053689).
- collector/nvd-index
- agent/softwarecombine
- agent/first-publish-date
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/event
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-0725
- agent/references
- agent/tags
- agent/trending
- vendor/keepass
- canonical/keepass keepass
- version/keepass keepass/2.48
- vendor/fedoraproject
- canonical/fedoraproject extra packages for enterprise linux
- version/fedoraproject extra packages for enterprise linux/7.0
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35