{"id":"CVE-2007-5201","aliases":["GHSA-wxcw-rqxc-hj85","PYSEC-2026-633"],"title":"FTP backend for Duplicity Discloses Passwords to Process Listing","summary":"FTP backend for Duplicity Discloses Passwords to Process Listing","severity":"medium","vendor":"duplicity","product":"duplicity","ecosystem":"pip","affected":["duplicity < 0.4.9"],"patched":["duplicity 0.4.9"],"published":"2022-05-01","updated":"2026-07-06","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-wxcw-rqxc-hj85","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-5201"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=293081"},{"url":"https://gitlab.com/duplicity/duplicity"},{"url":"https://web.archive.org/web/20080118045107/https://duplicity.nongnu.org/CHANGELOG"},{"url":"https://web.archive.org/web/20200228164800/http://www.securityfocus.com/bid/27771"},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00356.html"},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00445.html"},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=442840"}],"tags":["osv","pip"],"epss":0.00374,"epssPercentile":0.31165,"ingestedAt":"2026-07-08T18:25:53.932Z","slug":"CVE-2007-5201","body":"## Overview\n\nThe FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.\n\n## Affected packages\n\n- `duplicity < 0.4.9`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `duplicity 0.4.9`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}