Executive Summary

CVE-2025-67745 is a vulnerability in the myhoard package (versions prior to 1.3.0) where the software logs the entire backup information, including sensitive encryption keys, in plain text. This means that the encryption keys used to protect backups are exposed in log files, potentially allowing unauthorized parties to access them. The issue is due to improper handling of sensitive data in logs, classified as CWE-402 (Resource Leak). The vulnerability is fixed in version 1.3.0 by masking sensitive fields in logs. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to exposure of encryption keys through log files, which compromises the confidentiality of your backups. An attacker with access to these logs could obtain the encryption keys and decrypt backup data, leading to potential data breaches. The impact on confidentiality is high, while integrity and availability impacts are low or none. The attack can be performed remotely with low complexity and low privileges, without user interaction. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting the myhoard log files for the presence of backup encryption keys in plain text. Since the issue involves logging the entire backup info including sensitive encryption keys, you can search the logs for patterns that match encryption keys or related backup metadata. For example, you can use commands like `grep -r 'encryption_key' /path/to/myhoard/logs` or `grep -r 'basebackup_info' /path/to/myhoard/logs` to find exposed keys in logs. Additionally, monitoring network traffic for unencrypted transmission of backup keys could help, but the primary detection is through log inspection. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading myhoard to version 1.3.0 or later, where the vulnerability is fixed by masking sensitive fields in logs. If upgrading is not immediately possible, a temporary workaround is to redirect the myhoard logs to /dev/null to prevent sensitive data exposure. This prevents the encryption keys from being written to log files. Additionally, reviewing and applying the patch that masks sensitive fields in logs can help mitigate the issue. [1, 2]

Useful 0 Not Useful 0

Compliance Impact

This vulnerability exposes encryption keys in logs, which can lead to unauthorized access to sensitive backup data. Such exposure of sensitive information can result in non-compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls on the confidentiality and security of personal and protected health information. Therefore, the vulnerability increases the risk of violating these compliance requirements due to improper handling and logging of sensitive encryption keys. [1]

Useful 0 Not Useful 0