CVE-2014-6274

S3 and Glacier remotes creds embedded in the git repo were not encrypted

High · published June 26, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
6.9
In the wild
Unconfirmed
What it is

git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes

was set, and the remote used encryption=pubkey or encryption=hybrid,

the embedded AWS credentials were stored in the git repository

in (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00177 · 6.9th percentile
Published
2025-06-26T20:59Z
EPSS history
Timeline
  • 26 JUN 20:59Z
    S3 and Glacier remotes creds embedded in the git repo were not encrypted
    cvelistv5