PT-2017-6735 · Attic · Attic

Thomas Waldmann · Publicado 2017-08-18 · Atualizado 2022-05-17 · CVE-2015-4082

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions attic versions prior to 0.15

Description The issue allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by modifying the manifest type byte of the repository to indicate it is unencrypted. This is possible because the software does not confirm unencrypted backups with the user.

Recommendations For versions prior to 0.15, update to version 0.15 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-4082

GHSA-5X6Q-FFWJ-8VCF

PYSEC-2017-6

Produtos afetados

Attic

Referências · 14

• 🔥 https://github.com/jborg/attic/issues/271 · Exploit
• https://github.com/jborg/attic · Nota
• https://github.com/jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/attic/PYSEC-2017-6.yaml · Nota
• http://openwall.com/lists/oss-security/2015/05/31/3 · Nota
• https://ubuntu.com/security/CVE-2015-4082 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2017-6 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-4082 · Nota de Segurança
• http://securityfocus.com/bid/74821 · Nota
• https://cve.org/CVERecord?id=CVE-2015-4082 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-4082 · Aviso do Fabricante
• https://web.archive.org/web/20200517225455/http://securityfocus.com/bid/74821 · Nota
• https://osv.dev/vulnerability/GHSA-5x6q-ffwj-8vcf · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/05/25/3 · Nota