CVE-2015-4082 attic has improper verification of unencrypted backups
Attackers can bypass encryption checks in Attic backups by modifying the manifest, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-4082?
CVE-2015-4082 is a medium-severity vulnerability in n/a, published on 18 Aug 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to "unencrypted / without key file".
Weakness: CWE-264
Which versions are affected by CVE-2015-4082?
3 open source packages ship an affected version, including attic. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
attic PyPI | All versions | 0.15 |
attic PyPI | All versions | 0.15 |
attic PyPI | All versions | 0.15 |
Products include Attic Project Attic.
How do I fix CVE-2015-4082?
Upgrade attic to 0.15 or later.
Is CVE-2015-4082 being exploited?
There is no known exploitation of CVE-2015-4082 in the wild and no public exploit code.
Sources
Also known as GHSA-5x6q-ffwj-8vcf, PYSEC-2017-6, UBUNTU-CVE-2015-4082.