Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20180626160228.GA30329@kitenet.net>
Date: Tue, 26 Jun 2018 12:02:28 -0400
From: Joey Hess <id@...yh.name>
To: oss-security@...ts.openwall.com
Subject: CVE-2018-10857 and CVE-2018-10859: git-annex private data exposure

CVE-2018-10857: Some uses of git-annex were vulnerable to a private data
exposure and exfiltration attack. It could expose the content of files
located outside the git-annex repository, or content from a private web
server on localhost or the LAN. Joey Hess discovered this attack.

CVE-2018-10859: A malicious server for a special remote could
trick git-annex into decrypting a file that was encrypted to the user's gpg
key. This attack could be used to expose encrypted data that was never
stored in git-annex. Daniel Dent discovered this attack in collaboration
with Joey Hess.

git-annex version 6.20180626 fixes these problems.

https://git-annex.branchable.com/security/CVE-2018-10857_and_CVE-2018-10859/

-- 
see shy jo

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.