Revelation 0.4.13-2 and earlier uses only the first 32 characters of a password followed…
Priority LOW 26CWE-255Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Revelation 0.4.13-2 and earlier uses only the first 32 characters of a password followed by a sequence of zeros, which reduces the entropy and makes it easier for context-dependent attackers to crack passwords and obtain access to keys via a brute-force attack.
Why it matters now
EPSS 0.018 78th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mikel_olasagasti:revelation:*:*:*:*:*:*:*:* | up to 0.4.13-2 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.1.0:*:*:*:*:*:*:* | 0.1.0 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.1.1:*:*:*:*:*:*:* | 0.1.1 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.1.2:*:*:*:*:*:*:* | 0.1.2 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.2.0:*:*:*:*:*:*:* | 0.2.0 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.2.1:*:*:*:*:*:*:* | 0.2.1 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.3.0:*:*:*:*:*:*:* | 0.3.0 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.3.1:*:*:*:*:*:*:* | 0.3.1 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.3.2:*:*:*:*:*:*:* | 0.3.2 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.3.3:*:*:*:*:*:*:* | 0.3.3 | Vulnerable | Mikel Olasagasti |
- cpe:2.3:a:mikel_olasagasti:revelation:*:*:*:*:*:*:*:* Versions up to 0.4.13-2 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.1.0:*:*:*:*:*:*:* Versions 0.1.0 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.1.1:*:*:*:*:*:*:* Versions 0.1.1 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.1.2:*:*:*:*:*:*:* Versions 0.1.2 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.2.0:*:*:*:*:*:*:* Versions 0.2.0 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.2.1:*:*:*:*:*:*:* Versions 0.2.1 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.3.0:*:*:*:*:*:*:* Versions 0.3.0 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.3.1:*:*:*:*:*:*:* Versions 0.3.1 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.3.2:*:*:*:*:*:*:* Versions 0.3.2 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.3.3:*:*:*:*:*:*:* Versions 0.3.3 Vulnerable ·Mikel Olasagasti
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mikel_olasagasti:revelation:0.3.4:*:*:*:*:*:*:* | 0.3.4 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.4.0:*:*:*:*:*:*:* | 0.4.0 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.4.1:*:*:*:*:*:*:* | 0.4.1 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.4.2:*:*:*:*:*:*:* | 0.4.2 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.4.3:*:*:*:*:*:*:* | 0.4.3 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.4.4:*:*:*:*:*:*:* | 0.4.4 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.4.5:*:*:*:*:*:*:* | 0.4.5 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.4.6:*:*:*:*:*:*:* | 0.4.6 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.4.7:*:*:*:*:*:*:* | 0.4.7 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.4.8:*:*:*:*:*:*:* | 0.4.8 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.4.9:*:*:*:*:*:*:* | 0.4.9 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.4.10:*:*:*:*:*:*:* | 0.4.10 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.4.11:*:*:*:*:*:*:* | 0.4.11 | Vulnerable | Mikel Olasagasti |
| cpe:2.3:a:mikel_olasagasti:revelation:0.4.12:*:*:*:*:*:*:* | 0.4.12 | Vulnerable | Mikel Olasagasti |
- cpe:2.3:a:mikel_olasagasti:revelation:0.3.4:*:*:*:*:*:*:* Versions 0.3.4 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.4.0:*:*:*:*:*:*:* Versions 0.4.0 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.4.1:*:*:*:*:*:*:* Versions 0.4.1 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.4.2:*:*:*:*:*:*:* Versions 0.4.2 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.4.3:*:*:*:*:*:*:* Versions 0.4.3 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.4.4:*:*:*:*:*:*:* Versions 0.4.4 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.4.5:*:*:*:*:*:*:* Versions 0.4.5 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.4.6:*:*:*:*:*:*:* Versions 0.4.6 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.4.7:*:*:*:*:*:*:* Versions 0.4.7 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.4.8:*:*:*:*:*:*:* Versions 0.4.8 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.4.9:*:*:*:*:*:*:* Versions 0.4.9 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.4.10:*:*:*:*:*:*:* Versions 0.4.10 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.4.11:*:*:*:*:*:*:* Versions 0.4.11 Vulnerable ·Mikel Olasagasti
- cpe:2.3:a:mikel_olasagasti:revelation:0.4.12:*:*:*:*:*:*:* Versions 0.4.12 Vulnerable ·Mikel Olasagasti
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2012-2742
- 2026-10-03 Alias added: GHSA-48w5-fx89-4hg4
References
Other 5
- [oss-security] 20120618 CVE Request -- Revelation: 1) Limits effective password length to 32 characters 2) Doesn't iterate the passphrase through SHA algorithm to derive the encryption key
- [oss-security] 20120618 Re: CVE Request -- Revelation: 1) Limits effective password length to 32 characters 2) Doesn't iterate the passphrase through SHA algorithm to derive the encryption key
- https://bugs.gentoo.org/show_bug.cgi?id=421571
- http://oss.codepoet.no/revelation/issue/61/file-format-magic-string-version-mismatch
- http://knoxin.blogspot.co.uk/2012/06/revelation-password-manager-considered.html
More Mikel Olasagasti Revelation vulnerabilities
- TI-2012-02374 Revelation 0.4.13-2 and earlier does not iterate through SHA hashing algorithms for AES… CVSS 2.0MEDIUM 5.0
- TI-2012-03301 The fpm exporter in Revelation 0.4.13-2 and earlier encrypts the version number but not… CVSS 2.0LOW 2.1
Sources
- CVE-2012-2742 · CVE Program
- CVE-2012-2742 · NVD
- FIRST EPSS
- GHSA-48w5-fx89-4hg4 · GitHub Advisory Database · CC BY 4.0
- CVE-2012-2742 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences