CVE-2014-6274 — Missing Encryption of Sensitive Data in Git-annex

CWE-311 — Missing Encryption of Sensitive Data6 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.0%
top 87.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Git-annexGit-annex Project Git-annex
Timeline
PublishedJun 26
Latest updateNov 14

Description

git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5git-annex/git-annex3.20121126 — 5.20140919
▶Hackagegit-annex_project/git-annex0.20110401 — 5.20140919
▶NVDgit-annex_project/git-annex3.20121126 — 5.20140919
▶Debiangit-annex_project/git-annex< 5.20140919+3

🔴Vulnerability Details

4
OSV
git-annex plaintext storage of embedded credentials on encrypted remotes↗2025-11-14
▶
GHSA
GHSA-ppj6-rmfj-4vjx: git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the emb↗2025-06-26
▶
CVEList
S3 and Glacier remotes creds embedded in the git repo were not encrypted↗2025-06-26
▶
OSV
CVE-2014-6274: git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the emb↗2025-06-26
▶

📋Vendor Advisories

1
Debian
CVE-2014-6274: git-annex - git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was se...↗2014
▶
CVE-2014-6274 — Missing Encryption of Sensitive Data | cvebase