Git-Annex Project Git-Annex vulnerabilities

CVE-2014-6274 [HIGH] CWE-311 CVE-2014-6274: git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote us git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919.

CVE-2018-10857 [HIGH] CVE-2018-10857: git-annex is vulnerable to a private data exposure and exfiltration attack git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.

CVE-2018-10859 [HIGH] CVE-2018-10859: git-annex is vulnerable to an Information Exposure when decrypting files git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that was never stored in git-annex

CVE-2017-12976 [HIGH] CVE-2017-12976: git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL wit git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.