Vulnerability in git-annex: Exposure of Checksum to Encrypted Special Remotes
Summary
HSEC-2023-0012: git-annex checksum exposure to encrypted special remotes. Affects git-annex versions >= 0.20110417, < 6.20160419. Fixed in 6.20160419. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
git-annex is an open-source tool that manages files with Git, without checking the file contents into Git. It allows users to store and track large files efficiently. The tool provides a way to encrypt and store files in remote locations, known as encrypted special remotes. These remotes are not supposed to have access to the checksum of the unencrypted file. However, a bug in git-annex exposed the checksum of annexed files to encrypted special remotes when resuming uploads. This vulnerability is considered low-severity.
Vulnerability Detail
The vulnerability in git-annex allowed encrypted special remotes to access the checksum of unencrypted files. This exposure of checksums to unauthorized remotes could potentially lead to information leakage or unauthorized access to sensitive data. The issue only occurred when resuming uploads to encrypted special remotes. The vulnerability was addressed in the git-annex version 6.20160419.
How To Fix
Minimum fixed version
6.20160419
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in git-annex that exposed checksums to encrypted special remotes has been addressed in version 6.20160419. Users are advised to update their installations to the fixed version to mitigate the risk of information leakage or unauthorized access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git-annex →
FAQ
git-annex is an open-source tool that manages files with Git, allowing efficient storage and tracking of large files without checking their contents into Git.
Encrypted special remotes in git-annex are remote locations where files can be stored and tracked. These remotes are designed to provide encryption and security for the stored files.
The vulnerability in git-annex exposes the checksum of unencrypted files to encrypted special remotes. This could potentially lead to information leakage or unauthorized access to sensitive data.
The vulnerability is considered low-severity.
No, a CVE has not been assigned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for git-annex.
