GitHub Advisoryadvisory · PyPI
GHSA-5x6q-ffwj-8vcf attic has improper verification of unencrypted backups
HIGH
Official page ↗
- Aliases
- CVE-2015-4082
- Ecosystem
- PyPI
- Packages
- attic
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Reviewed
- 2024-05-01
Affected packages
• PyPI attic: < 0.15 → fixed in 0.15
Description
attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to "unencrypted / without key file".
Related
Alias · CVE (1)
- CVE-2015-4082 attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-4082 advisory
- https://github.com/jborg/attic/issues/271 web
- https://github.com/jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072 web
- https://github.com/jborg/attic package
- https://github.com/pypa/advisory-database/tree/main/vulns/attic/PYSEC-2017-6.yaml web
- https://web.archive.org/web/20200517225455/http://www.securityfocus.com/bid/74821 web
- http://www.openwall.com/lists/oss-security/2015/05/31/3 web
- http://www.securityfocus.com/bid/74821 web