[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20180626160228.GA30329@kitenet.net>
Date: Tue, 26 Jun 2018 12:02:28 -0400
From: Joey Hess <id@...yh.name>
To: oss-security@...ts.openwall.com
Subject: CVE-2018-10857 and CVE-2018-10859: git-annex private data exposure
CVE-2018-10857: Some uses of git-annex were vulnerable to a private data
exposure and exfiltration attack. It could expose the content of files
located outside the git-annex repository, or content from a private web
server on localhost or the LAN. Joey Hess discovered this attack.
CVE-2018-10859: A malicious server for a special remote could
trick git-annex into decrypting a file that was encrypted to the user's gpg
key. This attack could be used to expose encrypted data that was never
stored in git-annex. Daniel Dent discovered this attack in collaboration
with Joey Hess.
git-annex version 6.20180626 fixes these problems.
https://git-annex.branchable.com/security/CVE-2018-10857_and_CVE-2018-10859/
--
see shy jo
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
