CVE-2018-10859: Infoleak
Published Jul 16, 2018
·Updated
git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that was never stored in git-annex
Affected Software
2 affected components
Git-annex Project Git-annex
Debian Debian Linux=8.0
Event History
Jul 16, 2018
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-10859?
CVE-2018-10859 is classified as a medium severity vulnerability.
2
How do I fix CVE-2018-10859?
To fix CVE-2018-10859, update git-annex to the latest version provided by the maintainers.
3
What impact does CVE-2018-10859 have on users?
CVE-2018-10859 can lead to the exposure of sensitive data by allowing a malicious server to decrypt files intended for the user.
4
What software is affected by CVE-2018-10859?
CVE-2018-10859 affects git-annex and Debian Linux version 8.0.
5
Can CVE-2018-10859 be exploited remotely?
Yes, CVE-2018-10859 can be exploited by a malicious server that tricks git-annex into decrypting files.