CVE-2014-6274: git-annex plaintext storage of embedded credentials on encrypted remotes
Summary
CVE-2014-6274: git-annex plaintext storage of embedded credentials on encrypted remotes. Affects git-annex versions >= 0.20110401, < 5.20140919. Fixed in 5.20140919. How to fix ↓
Also tracked for
- git-annex · Debian:11
The same CVE-2014-6274 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
git-annex is an open-source tool that manages files with Git, without checking the file contents into Git. It allows users to store and track large files, including those stored on remote servers. The tool supports various types of remotes, including S3 and Glacier for storing files on Amazon Web Services (AWS). The vulnerability in git-annex involves the plaintext storage of embedded AWS credentials on encrypted remotes, which can be accessed by unauthorized individuals.
Vulnerability Detail
The vulnerability in git-annex arises when the 'embedcreds' option is set to 'yes' for S3 or Glacier remotes that use 'encryption=pubkey' or 'encryption=hybrid'. In this scenario, the AWS credentials are stored in the Git repository in plaintext, instead of being encrypted as intended. This means that anyone who obtains a copy of the Git repository can extract the AWS credentials, posing a significant security risk.
How To Fix
Minimum fixed version
5.20140919
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in git-annex allows for the plaintext storage of embedded AWS credentials on encrypted remotes, posing a significant security risk. To mitigate this vulnerability, it is crucial to update AWS credentials, use a fixed version of git-annex, and re-embed the encrypted credentials into the repository. Alternatively, removing the history of the git-annex branch can also address the issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git-annex →
FAQ
git-annex is an open-source tool that manages files with Git, allowing users to store and track large files without checking the file contents into Git.
The vulnerability affects S3 and Glacier remotes in git-annex that use 'encryption=pubkey' or 'encryption=hybrid' and have the 'embedcreds' option set to 'yes'.
The vulnerability allows unauthorized individuals who obtain a copy of the Git repository to extract AWS credentials stored in plaintext. This can lead to unauthorized access and misuse of AWS resources.
To fix the vulnerability, you should change your AWS credentials to invalidate the ones stored in plaintext. Then, ensure you have a fixed version of git-annex and re-embed the new encrypted credentials into the repository. Alternatively, you can remove the history of the git-annex branch containing plaintext credentials.
If you are certain that you are the only one with access to the repository, you may choose to leave it as-is. However, it is recommended to follow the remediation steps to ensure the security of your AWS credentials.
Related vulnerabilities
Recent vulnerabilities recorded for git-annex.
