[<prev] [day] [month] [year] [list]
Message-ID: <d003d52d-17fa-4830-baf0-db787ca5e52c@oracle.com>
Date: Fri, 23 May 2025 14:24:14 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-48708: ghostscript can embed plaintext password in encrypted
PDFs
https://www.cve.org/CVERecord?id=CVE-2025-48708 was published today with
this description:
gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript
before 10.05.1 lacks argument sanitization for the # case. A created PDF
document includes its password in cleartext.
The bug report at https://bugs.ghostscript.com/show_bug.cgi?id=708446 says:
When generating a password-protected PDF using the latest version of the tool
on Windows 10, I noticed that the full command-line input, including the
plaintext password, is embedded at the beginning of the generated PDF file.
This allows anyone with access to the PDF to retrieve the password simply by
running a command like "type" (Windows) or "cat" (Linux/macOS) on the file.
The fix included in the 10.05.1 release appears to be:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?h=gs10.05.1&id=5b5968c306b3e35cdeec83bb15026fd74a7334de
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
