PT-2017-6735 · Attic · Attic

Thomas Waldmann · Published 2017-08-18 · Updated 2022-05-17 · CVE-2015-4082

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions attic versions prior to 0.15

Description The issue allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by modifying the manifest type byte of the repository to indicate it is unencrypted. This is possible because the software does not confirm unencrypted backups with the user.

Recommendations For versions prior to 0.15, update to version 0.15 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-4082

GHSA-5X6Q-FFWJ-8VCF

PYSEC-2017-6

Affected Products

Attic

References · 14

• 🔥 https://github.com/jborg/attic/issues/271 · Exploit
• https://ubuntu.com/security/CVE-2015-4082 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-4082 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-4082 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-4082 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5x6q-ffwj-8vcf · Vendor Advisory
• https://github.com/jborg/attic · Note
• https://github.com/jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/attic/PYSEC-2017-6.yaml · Note
• http://openwall.com/lists/oss-security/2015/05/31/3 · Note
• http://securityfocus.com/bid/74821 · Note
• https://web.archive.org/web/20200517225455/http://securityfocus.com/bid/74821 · Note
• http://openwall.com/lists/oss-security/2015/05/25/3 · Note