High
password-store — security advisory
pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members' machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn't correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.
- Products
- password-store
- Affected versions
- 1.6.5-1, 1.6.5-2, 1.6.5-3, 1.7.1-3, 1.7.3-2, 1.7.4-1, 1.7.4-2, 1.7.4-3, 1.7.4-4, 1.7.4-5, 1.7.4-6, 1.7.4-7, 1.7.4-8
- Fixed versions
- Not specified
- CVEs
- CVE-2020-28086
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:38 UTC · Revision 1
Source evidence
pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members' machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn't correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.
osv:UBUNTU-CVE-2020-28086
password-store
Fixed versions: Not specified
password-store
Fixed versions: Not specified
password-store
Fixed versions: Not specified
password-store
Fixed versions: Not specified
password-store
Fixed versions: Not specified
password-store
Fixed versions: Not specified
password-store
Fixed versions: Not specified
password-store
Fixed versions: Not specified
Complete source record
{
"id": "de7a36e1c51e6f4e2d1c537e98a240162cada7f684f9af30d16c63733bba49d3",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-28086",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2020-28086",
"summary": "pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members' machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn't correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.",
"evidence": "osv:UBUNTU-CVE-2020-28086",
"products": [
{
"name": {
"value": "password-store",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6.5-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5-2",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5-3",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "password-store",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7.1-3",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "password-store",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7.3-2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "password-store",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7.4-1",
"evidence": "/affected/3/versions"
},
{
"value": "1.7.4-2",
"evidence": "/affected/3/versions"
},
{
"value": "1.7.4-3",
"evidence": "/affected/3/versions"
},
{
"value": "1.7.4-4",
"evidence": "/affected/3/versions"
},
{
"value": "1.7.4-5",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "password-store",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7.4-6",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "password-store",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7.4-7",
"evidence": "/affected/5/versions"
},
{
"value": "1.7.4-8",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "password-store",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7.4-8",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "password-store",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7.4-8",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2020-28086",
"aliases": [
"UBUNTU-CVE-2020-28086"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
{
"type": "Ubuntu",
"score": "low"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "password-store",
"purl": "pkg:deb/ubuntu/password-store?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1.6.5-1",
"1.6.5-2",
"1.6.5-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-28086.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "pass",
"binary_version": "1.6.5-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "password-store",
"purl": "pkg:deb/ubuntu/password-store?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.7.1-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-28086.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "pass",
"binary_version": "1.7.1-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "password-store",
"purl": "pkg:deb/ubuntu/password-store?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.7.3-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-28086.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "pass",
"binary_version": "1.7.3-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "password-store",
"purl": "pkg:deb/ubuntu/password-store?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.7.4-1",
"1.7.4-2",
"1.7.4-3",
"1.7.4-4",
"1.7.4-5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-28086.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "elpa-password-store",
"binary_version": "1.7.4-5"
},
{
"binary_name": "pass",
"binary_version": "1.7.4-5"
},
{
"binary_name": "vim-redact-pass",
"binary_version": "1.7.4-5"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "password-store",
"purl": "pkg:deb/ubuntu/password-store?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.7.4-6"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-28086.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "elpa-password-store",
"binary_version": "1.7.4-6"
},
{
"binary_name": "pass",
"binary_version": "1.7.4-6"
},
{
"binary_name": "vim-redact-pass",
"binary_version": "1.7.4-6"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "password-store",
"purl": "pkg:deb/ubuntu/password-store?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.7.4-7",
"1.7.4-8"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-28086.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "elpa-password-store",
"binary_version": "1.7.4-8"
},
{
"binary_name": "pass",
"binary_version": "1.7.4-8"
},
{
"binary_name": "vim-redact-pass",
"binary_version": "1.7.4-8"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "password-store",
"purl": "pkg:deb/ubuntu/password-store?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.7.4-8"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-28086.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "elpa-password-store",
"binary_version": "1.7.4-8"
},
{
"binary_name": "pass",
"binary_version": "1.7.4-8"
},
{
"binary_name": "vim-redact-pass",
"binary_version": "1.7.4-8"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "password-store",
"purl": "pkg:deb/ubuntu/password-store?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.7.4-8"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-28086.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "elpa-password-store",
"binary_version": "1.7.4-8"
},
{
"binary_name": "pass",
"binary_version": "1.7.4-8"
},
{
"binary_name": "vim-redact-pass",
"binary_version": "1.7.4-8"
}
]
}
}
],
"modified": "2026-10-17T12:55:52.885555687Z",
"provider": "osv",
"upstream": [
"CVE-2020-28086"
],
"references": [
"https://ubuntu.com/security/CVE-2020-28086",
"https://lists.zx2c4.com/pipermail/password-store/2014-March/000498.html",
"https://www.cve.org/CVERecord?id=CVE-2020-28086"
]
},
"related_cves": [
{
"value": "CVE-2020-28086",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 354208,
"published_at": "2020-12-09T19:15:00+00:00"
}