Alerts This Week
Warning Icon 1 485
Alerts This Week
Warning Icon 1 485

Debian Jessie: DLA-1495-1 Critical: Git-Annex Command Execution Issue

debian lts
Calendar Grey September 5, 2018
Dist Debian Esm H88
Critical security flaw patched in git-annex for Debian LTS. Users are advised to update promptly.
The git-annex package was found to have multiple vulnerabilities when operating on untrusted data that could lead to arbitrary command execution and encrypted data exfiltration
Topics%20covered

Topics Covered

security advisory update critical debian command execution data exposure git-annex

Summary

git-annex before 6.20170818 allows remote attackers to execute
arbitrary commands via an ssh URL with an initial dash character
in the hostname, as demonstrated by an ssh://-eProxyCommand= URL,
a related issue to CVE-2017-9800, CVE-2017-12836,
CVE-2017-1000116, and CVE-2017-1000117.

CVE-2018-10857

git-annex is vulnerable to a private data exposure and
exfiltration attack. It could expose the content of files located
outside the git-annex repository, or content from a private web
server on localhost or the LAN.

CVE-2018-10859

git-annex is vulnerable to an Information Exposure when decrypting
files. A malicious server for a special remote could trick
git-annex into decrypting a file that was encrypted to the user's
gpg key. This attack could be used to expose encrypted data that
was never stored in git-annex

For Debian 8 "Jessie", these problems have been fixed in version
5.20141125+oops-1+deb8u2.

Read the Full Advisory


Severity
critical
Lowest
Low
Medium
High
Critical

<pre><font face="Courier">Package: git-annex
Version: 5.20141125+oops-1+deb8u2
CVE ID: CVE-2017-12976 CVE-2018-10857 CVE-2018-10859
Debian Bug: 873088

Topics%20covered

Topics Covered

security advisory update critical debian command execution data exposure git-annex

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here