CVE-2020-28638: Dyne Tomb

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

ask_password in Tomb 2.0 through 2.7 returns a warning when pinentry-curses is used and $DISPLAY is non-empty, causing affected users' files to be encrypted with "tomb {W] Detected DISPLAY, but only pinentry-curses is found." as the encryption key.

Affected products

• Dyne Tomb: from 2.0, up to and including 2.7

Published 2020-11-13. Last modified 2026-06-17.