PT-2018-10145 · Joey Hess+1 · Git-Annex+1

Joey Hess · Published 2018-07-06 · Updated 2025-11-14 · CVE-2018-10857

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions git-annex (affected versions not specified)

Description The issue concerns a private data exposure and exfiltration attack in git-annex. It could expose the content of files located outside the git-annex repository or content from a private web server on localhost or the LAN. To perform this attack, the attacker needs to have control over one of the remotes of the victim's git-annex repository. The attack can be performed by running git-annex addurl --relaxed file:///etc/passwd and committing this to the repository. The attacker can also use URLs to private web servers. The issue was discovered by Joey Hess.

Recommendations To fix the issue, git-annex was updated to refuse to follow file:/// URLs and URLs pointing to private/local IP addresses by default. Two new configuration settings, annex.security.allowed-url-schemes and annex.security.allowed-ip-addresses, can relax this security policy. As a temporary workaround, consider disabling the git-annex assistant or restricting the use of git annex sync --content until the issue is resolved. Restrict access to the vulnerable git-annex repository to minimize the risk of exploitation. Avoid using git-annex addurl --relaxed with untrusted URLs. Developers of external special remotes are encouraged to prevent this attack by not following such HTTP redirects.

Note: The provided information does not specify the exact versions of git-annex that are affected by this issue. Therefore, it is recommended to update git-annex to the latest version available. If no specific fix is provided for a particular version, it is recommended to follow the general guidelines for securing git-annex repositories.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-10857

DLA-1495-1

HSEC-2023-0010

HSEC-2023-0011

OPENSUSE-SU-2018_1896-1

Affected Products

Suse

Git-Annex

References · 17

• https://osv.dev/vulnerability/DEBIAN-CVE-2018-10857 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-10857 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-10857 · Vendor Advisory
• https://osv.dev/vulnerability/HSEC-2023-0010 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-10857 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1495-1 · Vendor Advisory
• https://osv.dev/vulnerability/HSEC-2023-0011 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-10857 · Security Note
• https://ubuntu.com/security/CVE-2018-10857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10857 · Security Note
• https://github.com/haskell/security-advisories · Note
• https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export · Note
• https://haskell.github.io/security-advisories · Note
• http://openwall.com/lists/oss-security/2018/06/26/4 · Note
• https://lists.debian.org/debian-lts-announce/2018/09/msg00004.html · Note