Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

duplicity: password disclosure

Package(s):

duplicity

CVE #(s):

CVE-2007-5201

Created:

February 13, 2008

Updated:

February 13, 2008

Description:

From the CVE:

The FTP backend for Duplicity sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.

Alerts:

Fedora	FEDORA-2008-1521	2008-02-13
Fedora	FEDORA-2008-1584	2008-02-13

(Log in to post comments)

duplicity: password disclosure

Posted Feb 14, 2008 20:21 UTC (Thu) by kreutzm (subscriber, #4700) [Link]

Debian Sarge and Etch are not vulnerable.