CVE-2020-12755

Name of the Vulnerable Software and Affected Versions kio-extras versions through 20.04.0

Description The issue arises from the fishProtocol::establishConnection function in fish/fish.cpp, which makes a cacheAuthentication call even when the user has not set the keepPassword option. This may result in unintended storage of a password in KWallet.

Recommendations For versions through 20.04.0, consider disabling the cacheAuthentication call when the keepPassword option is not set, or avoid using the fishProtocol::establishConnection function until a patch is available. As a temporary workaround, restrict access to the KWallet storage to minimize the risk of unintended password storage.