Sicherheit: Zwei Probleme in git-annex
Aktuelle Meldungen Distributionen
Name: Zwei Probleme in git-annex
ID: FEDORA-2018-e22c8eb218
Distribution: Fedora
Plattformen: Fedora 28
Datum: Mi, 11. Juli 2018, 22:51
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10859
Applikationen: git-annex


Fedora Update Notification
2018-07-11 20:15:57.507790

Name : git-annex
Product : Fedora 28
Version : 6.20180626
Release : 1.fc28
URL : https://hackage.haskell.org/package/git-annex
Summary : Manage files with git, without checking their contents into git
Description :
Git-annex allows managing files with git, without checking the file contents
into git. While that may seem paradoxical, it is useful when dealing with files
larger than git can currently easily handle, whether due to limitations in
memory, time, or disk space.

It can store large files in many places, from local hard drives, to a large
number of cloud storage services, including S3, WebDAV, and rsync, with a dozen
cloud storage providers usable via plugins. Files can be stored encrypted with
gpg, so that the cloud storage provider cannot see your data.
git-annex keeps track of where each file is stored, so it knows how many copies
are available, and has many facilities to ensure your data is preserved.

git-annex can also be used to keep a folder in sync between computers, noticing
when files are changed, and automatically committing them to git and
transferring them to other computers. The git-annex webapp makes it easy to set
up and use git-annex this way.

Update Information:

Update to 6.20180626 Security fix for CVE-2018-10857 and CVE-2018-10859

* Thu Jun 28 2018 Elliott Sales de Andrade <quantum.analyst@gmail.com> -
- update to 6.20180626
- Fix CVE-2018-10857 and CVE-2018-10859 (#1595634)
* Fri Apr 20 2018 Elliott Sales de Andrade <quantum.analyst@gmail.com> -
- update to 6.20180409

[ 1 ] Bug #1595631 - CVE-2018-10857 git-annex: Private data exposure and
[ 2 ] Bug #1595633 - CVE-2018-10859 git-annex: Malicious server could trick
git-annex into decrypting a file encrypted to the user's gpg key

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-e22c8eb218' at the command
line. For more information, refer to the dnf documentation available at

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N27SN5NCGQYHJ6OQMHGUO7OBWRDYDIXM/
Unterstützer werden
Neue Nachrichten