CVE-2018-10859: git-annex GPG decryption attack via compromised remote
Summary
CVE-2018-10859: git-annex GPG decryption attack via compromised remote. Affects git-annex versions >= 0.20110417, < 6.20180626. Fixed in 6.20180626. How to fix ↓
Also tracked for
- git-annex · Debian:11
The same CVE-2018-10859 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
git-annex is a tool that manages files with git, without checking the file contents into git. It allows users to store and track large files, such as media files or datasets, in a distributed manner. The tool uses special remotes to store files in various locations, including cloud storage providers. These special remotes can be configured to encrypt the files using the user's GPG key for added security.
Vulnerability Detail
A malicious server hosting an encrypted special remote could exploit a vulnerability in git-annex to trick it into decrypting a file that was encrypted to the user's GPG key. This attack could lead to the exposure of encrypted data that was never stored in git-annex. The attacker needs control of a server hosting the special remote used by the victim's git-annex repository. By using an innocuous URL and waiting for the victim's git-annex to download and upload an encrypted copy to the compromised special remote, the attacker can later replace the downloaded content with the GPG-encrypted file they want to have decrypted. When the victim downloads the content from the special remote, the attacker sends them the GPG-encrypted file instead, which git-annex mistakenly decrypts. This attack can be used to access sensitive information that may have been exfiltrated from the victim's system through a related attack (CVE-2018-10857). The issue was fixed by making git-annex refuse to download encrypted content from special remotes unless it knows the hash of the expected content.
How To Fix
Minimum fixed version
6.20180626
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update git-annex to the latest version as soon as possible.
Conclusion
The git-annex GPG decryption attack via compromised remote (CVE-2018-10859) allows an attacker to trick git-annex into decrypting a file that was encrypted to the user's GPG key. This can lead to the exposure of encrypted data that was never stored in git-annex. To fix this vulnerability, users should update git-annex to version 6.20180626 or later. There is no known workaround for this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git-annex →
FAQ
git-annex is a tool that manages files with git, allowing users to store and track large files in a distributed manner.
The attacker needs control of a server hosting an encrypted special remote used by the victim's git-annex repository. By tricking git-annex into downloading an innocuous URL and later replacing the downloaded content with a GPG-encrypted file, the attacker can make git-annex mistakenly decrypt the file using the victim's GPG key.
The attacker can access encrypted data that was never stored in git-annex, potentially exposing sensitive information that may have been exfiltrated from the victim's system through a related attack.
The issue was fixed by making git-annex refuse to download encrypted content from special remotes unless it knows the hash of the expected content. This prevents the decryption attack from succeeding.
You can update git-annex by running the command 'git annex upgrade' after installing version 6.20180626 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for git-annex.
