SB2019032135 - Multiple vulnerabilities in jaredhanson passport

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cleartext storage of sensitive information (CVE-ID: CVE-2018-17499)

The vulnerability allows a local authenticated user to gain access to sensitive information.

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information.

2) Credentials management (CVE-ID: CVE-2018-17500)

The vulnerability allows a local authenticated user to execute arbitrary code.

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information.

Remediation

Install update from vendor's website.

References

• https://exchange.xforce.ibmcloud.com/vulnerabilities/149659
• https://exchange.xforce.ibmcloud.com/vulnerabilities/149660