Exposed AWS Credentials in git-annex: CVE-2014-6274 Vulnerability
Summary
DEBIAN-CVE-2014-6274: git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in (effectivel... Affects git-annex versions < 5.20140919. Fixed in 5.20140919. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
git-annex is a powerful tool that allows users to manage files with Git without checking the files into Git. It is particularly useful for handling large files or files that are not suitable for version control. The tool supports various remote storage options, including S3 and Glacier, which are popular for cloud storage. However, a vulnerability was identified in git-annex that could lead to the exposure of sensitive AWS credentials when certain configurations are used.
Vulnerability Detail
The vulnerability, identified as CVE-2014-6274, arises from a flaw in the handling of AWS credentials within git-annex when using S3 and Glacier remotes. If the configuration option 'embedcreds=yes' is set, and the remote uses either 'encryption=pubkey' or 'encryption=hybrid', the AWS credentials are stored in the git repository in plaintext instead of being encrypted. This could potentially allow unauthorized access to AWS resources, leading to data breaches or other malicious activities.
How To Fix
Minimum fixed version
5.20140919
This is the first release that contains the fix.
sudo apt-get install --only-upgrade git-annexTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid setting 'embedcreds=yes' in their git-annex configuration until they can update to the patched version. Additionally, consider using alternative encryption methods that do not expose credentials.
Conclusion
The CVE-2014-6274 vulnerability in git-annex poses a significant risk by exposing AWS credentials in plaintext. Users are strongly advised to update to the patched version to mitigate this risk. Until an update can be applied, users should avoid configurations that lead to credential exposure.
See every vulnerability recorded for git-annex →
FAQ
CVE-2014-6274 is a vulnerability in git-annex that allows AWS credentials to be stored in plaintext if certain configurations are used.
Any version of git-annex prior to 5.20140919 with 'embedcreds=yes' set in the configuration and using S3 or Glacier remotes is affected.
The main risk is the exposure of AWS credentials, which could lead to unauthorized access to AWS resources and potential data breaches.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application against this vulnerability using the Vulert playground.
If an immediate update is not possible, ensure that 'embedcreds=yes' is not set in your configuration and consider using alternative encryption methods.
References
Related vulnerabilities
Recent vulnerabilities recorded for git-annex.
