git-annex checksum exposure to encrypted special remotes
Affects git-annexSource GCVE Database
Rated Low by Threat Radar's AI analysis
- Patch
- Available – fixed in 6.20160419
Data as of 13 Nov 2026, 18:40 UTC
What to do
Upgrade git-annex to 6.20160419.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hackagegit-annex | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade git-annex to version 6.20160419 or later, where this issue has been fixed. No other mitigation is required as the patch fully addresses the vulnerability.
Description
A vulnerability in git-annex exposed the checksum of annexed files to encrypted special remotes during resumed uploads. Encrypted special remotes are not supposed to access the checksum of the unencrypted file, but due to this bug, the checksum was leaked. This issue is considered low severity and was fixed in git-annex version 6.20160419.