Vulnerability in crip package (CVE-2005-0393)
Summary
CVE-2005-0393: The helper scripts for crip 3.5 do not properly use temporary files, which allows local users to have an unknown impact with unknown attack vectors. Affects crip versions < 3.5-1sarge2. Fixed in 3.5-1sarge2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The crip package is a utility for encrypting and decrypting files using the crypt(3) routine. It provides a command-line interface for users to easily encrypt and decrypt their files. However, the helper scripts for crip 3.5 do not properly use temporary files, which introduces a vulnerability that can be exploited by local users.
Vulnerability Detail
The vulnerability in the crip package arises from the improper use of temporary files by the helper scripts. This flaw allows local users to potentially exploit the system with unknown attack vectors. The exact impact of this vulnerability is unknown.
How To Fix
Minimum fixed version
3.5-1sarge2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade cripTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The crip package is vulnerable to an issue related to the improper use of temporary files in its helper scripts. This vulnerability can potentially be exploited by local users, although the exact impact is unknown. To mitigate this vulnerability, it is recommended to update the crip package to version 3.5-1sarge2 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for crip →
FAQ
The exact impact of this vulnerability is unknown, but it has the potential to be exploited by local users.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and it will alert you in real-time if the vulnerability is present.
Yes, updating the crip package to version 3.5-1sarge2 or later will fix this vulnerability.
There are no known exploits for this vulnerability at this time.
For more information about this vulnerability, you can refer to the CVE-2005-0393 entry at https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2005-0393.json
Related vulnerabilities
Recent vulnerabilities recorded for crip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
