CVE-2018-10857 Information disclosure in git-annex
Attackers can expose content of files outside the repository or from private local web servers via git-annex.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-10857?
CVE-2018-10857 is a medium-severity vulnerability in Debian Debian Linux, published on 16 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.
Weakness: CWE-200
Which versions are affected by CVE-2018-10857?
1 open source package ship an affected version, including git-annex. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
git-annex Hackage | All versions | 6.20180626 |
Products include Debian Debian Linux, Git-Annex Project Git-Annex.
How do I fix CVE-2018-10857?
Upgrade git-annex to 6.20180626 or later.
Is CVE-2018-10857 being exploited?
There is no known exploitation of CVE-2018-10857 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-10857, GHSA-f7cm-x4r7-4852, HSEC-2023-0010, UBUNTU-CVE-2018-10857.