PT-2023-10181 · Git-Annex · Git-Annex

Published

2023-07-25

·

Updated

2025-11-14

·

CVE-2014-6274

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions git-annex versions (affected versions not specified)
Description The issue concerns the storage of embedded credentials on encrypted remotes in git-annex. When embedcreds=yes is set and the remote uses encryption=pubkey or encryption=hybrid, the embedded AWS credentials are stored in the Git repository in plaintext, rather than being encrypted. This allows anyone with a copy of the Git repository to extract the AWS credentials.
Recommendations To resolve the issue, consider the following approaches:
  1. Change your AWS credentials and then re-embed the new credentials into the repository, encrypted this time, by setting the AWS SECRET ACCESS KEY and AWS ACCESS KEY ID environment variables, and running git annex enableremote $remotename embedcreds=yes.
  2. Fix the problem, rewrite the embedded credentials with encryption, and then remove the history of the git-annex branch of the repository by using git annex forget.
  3. If you are certain that you are the only one with access to the repository, you could decide to leave it as-is, acknowledging that it is no more insecure than using encryption=shared. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2014-6274
HSEC-2023-0013

Affected Products

Git-Annex