PT-2023-35500 · Git-Annex · Git-Annex

Published 2023-07-25 · Updated 2025-11-14

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions git-annex versions prior to 6.20160419

Description A bug in git-annex exposed the checksum of annexed files to encrypted special remotes, which should not have access to this information. This issue occurred when resuming uploads to the encrypted special remote and is considered a low-severity security hole.

Recommendations For versions prior to 6.20160419, update to git-annex version 6.20160419 to resolve the issue. As a temporary workaround, consider avoiding resuming uploads to encrypted special remotes until the update is applied.

Related Identifiers

HSEC-2023-0012

Affected Products

Git-Annex

References · 6

• https://osv.dev/vulnerability/HSEC-2023-0012 · Vendor Advisory
• https://github.com/haskell/security-advisories · Note
• http://source.git-annex.branchable.com/?p=source.git;a=commitdiff;h=b890f3a53d936b5e40aa9acc5876cb98f18b9657 · Note
• https://haskell.github.io/security-advisories · Note
• https://git-annex.branchable.com/security/checksum_exposure_to_encrypted_special_remotes · Note
• https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export · Note