← Back

Git Annex

git-annex

Vendor: Git Annex Project • 4 CVEs

CVEs (4)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-6274
1Git Annex Project
1Git Annex
Aug 6, 2025
Jun 26, 2025
N/A· v4
7.5 HIGH· v3
N/A· v2
git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in (effectivel...Show more
git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919.Show less
CVE-2018-10857
2Debian
Git Annex Project
2Debian Linux
Git Annex
Nov 21, 2024
Jul 16, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.
CVE-2018-10859
2Debian
Git Annex Project
2Debian Linux
Git Annex
Nov 21, 2024
Jul 16, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could b...Show more
git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that was never stored in git-annexShow less
CVE-2017-12976
1Git Annex Project
1Git Annex
May 13, 2026
Aug 20, 2017
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-201...Show more
git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.Show less