HSEC-2023-0012 git-annex checksum exposure to encrypted special remotes
An attacker with access to an encrypted special remote can obtain file checksums during resumed uploads, leaking metadata about unencrypted files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is HSEC-2023-0012?
HSEC-2023-0012 is a vulnerability in git-annex, published on 14 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
git-annex checksum exposure to encrypted special remotes
A bug exposed the checksum of annexed files to encrypted special remotes, which are not supposed to have access to the checksum of the un-encrypted file. This only occurred when resuming uploads to the encrypted special remote, so it is considered a low-severity security hole.
For details, see commit b890f3a53d936b5e40aa9acc5876cb98f18b9657.
No CVE was assigned for this issue.
Fixed in git-annex-6.20160419.
Which versions are affected by HSEC-2023-0012?
1 open source package ship an affected version, including git-annex.
| Package | Affected | Fixed in |
|---|---|---|
git-annex Hackage | From 0.20110417 | 6.20160419 |
How do I fix HSEC-2023-0012?
Upgrade git-annex to 6.20160419 or later.
Is HSEC-2023-0012 being exploited?
There is no known exploitation of HSEC-2023-0012 in the wild and no public exploit code.