HSEC-2023-0012
git-annex checksum exposure to encrypted special remotes
git-annex checksum exposure to encrypted special remotes
A bug exposed the checksum of annexed files to encrypted special remotes, which are not supposed to have access to the checksum of the un-encrypted file. This only occurred when resuming uploads to the encrypted special remote, so it is considered a low-severity security hole.
For details, see commit b890f3a53d936b5e40aa9acc5876cb98f18b9657.
No CVE was assigned for this issue.
Fixed in git-annex-6.20160419.
What each source reports
OSV No score
git-annex checksum exposure to encrypted special remotes
git-annex checksum exposure to encrypted special remotes
A bug exposed the checksum of annexed files to encrypted special remotes, which are not supposed to have access to the checksum of the un-encrypted file. This only occurred when resuming uploads to the encrypted special remote, so it is considered a low-severity security hole.
For details, see commit b890f3a53d936b5e40aa9acc5876cb98f18b9657.
No CVE was assigned for this issue.
Fixed in git-annex-6.20160419.
- Record
HSEC-2023-0012- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
git-annexHackage |
0.20110417 up to 6.20160419, plus listed versions 3.201107023.20110702.23.201107053.201107073.20110819 Show 45 moreShow less3.201109023.201109063.201109153.201109283.201110113.201111223.201112033.201112113.201112313.201201133.201201153.201201163.201201233.201202273.201202293.201202303.201203093.201203153.201204053.201204063.201204183.201204303.201205113.201205223.201206053.201206113.201206143.201206153.201206243.201206293.201207213.201208073.201208253.201209243.201210013.201210093.201210103.201210163.201210173.201211123.201211263.201211273.20121127.13.201212113.20130102 |
6.20160419 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
HSEC-2023-0012 is a vulnerability with no CVSS score yet in git-annex, published November 14, 2025. No source lists public exploit code. Fixed in git-annex 6.20160419.
References
Left out here: 105 versions. The JSON record has them.