HighCVSS 7.5
EPSS 0.94%
duplicity 0.6.24 has improper verification of SSL certificates
Product
debian/duplicity vulnerabilities
2 published CVES affecting debian/duplicity, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 2
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest debian/duplicity CVEs
Newest publication first
-
-
MediumCVSS 4.6 EPSS 0.37%
The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.