Date: Tue, 26 Jun 2018 12:02:28 -0400 From: Joey Hess <id@...yh.name> To: oss-security@...ts.openwall.com Subject: CVE-2018-10857 and CVE-2018-10859: git-annex private data exposure CVE-2018-10857: Some uses of git-annex were vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN. Joey Hess discovered this attack. CVE-2018-10859: A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that was never stored in git-annex. Daniel Dent discovered this attack in collaboration with Joey Hess. git-annex version 6.20180626 fixes these problems. https://git-annex.branchable.com/security/CVE-2018-10857_and_CVE-2018-10859/ -- see shy jo Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.