UBUNTU-CVE-2015-4082
Dashboard / Vulnerabilities / UBUNTU-CVE-2015-4082
Summary:
Details: attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to "unencrypted / without key file".
References: https://ubuntu.com/security/CVE-2015-4082, https://github.com/jborg/attic/issues/271, https://github.com/jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072, http://www.openwall.com/lists/oss-security/2015/05/25/3, https://www.cve.org/CVERecord?id=CVE-2015-4082
Affected packages
Package
Name: attic
Purl: pkg:deb/ubuntu/[email protected]+esm1?arch=source&distro=trusty/esm
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -0.10-1.1ubuntu0.1+esm1
Affected versions
0.7-1
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
