CVE-2014-6274 (GCVE-0-2014-6274)

Vulnerability from cvelistv5 – Published: 2025-06-26 20:59 – Updated: 2025-06-27 18:41

Title

S3 and Glacier remotes creds embedded in the git repo were not encrypted

Summary

git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-27 18:41 UTC

CWE

CWE-311 - Missing Encryption of Sensitive Data

Assigner

debian mitre root

References

1 reference

URL	Tags
https://git-annex.branchable.com/upgrades/insecur…

Impacted products

1 product

Vendor	Product	Version	CPE status
git-annex	git-annex	Affected: 3.20121126 , < 5.20140919 (custom)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2014-6274",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-27T18:41:28.793228Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-311",
                "description": "CWE-311 Missing Encryption of Sensitive Data",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-27T18:41:32.782Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "git-annex",
          "vendor": "git-annex",
          "versions": [
            {
              "lessThan": "5.20140919",
              "status": "affected",
              "version": "3.20121126",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003egit-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes\nwas set, and the remote used encryption=pubkey or encryption=hybrid,\nthe embedded AWS credentials were stored in the git repository\nin (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919.\u003c/div\u003e"
            }
          ],
          "value": "git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes\nwas set, and the remote used encryption=pubkey or encryption=hybrid,\nthe embedded AWS credentials were stored in the git repository\nin (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-26T20:59:54.999Z",
        "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
        "shortName": "debian"
      },
      "references": [
        {
          "url": "https://git-annex.branchable.com/upgrades/insecure_embedded_creds/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "S3 and Glacier remotes creds embedded in the git repo were not encrypted",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
    "assignerShortName": "debian",
    "cveId": "CVE-2014-6274",
    "datePublished": "2025-06-26T20:59:54.999Z",
    "dateReserved": "2014-09-09T00:00:00.000Z",
    "dateUpdated": "2025-06-27T18:41:32.782Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2014-6274",
      "date": "2026-09-16",
      "epss": "0.00165",
      "percentile": "0.06088"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-6274\",\"sourceIdentifier\":\"security@debian.org\",\"published\":\"2025-06-26T21:15:27.647\",\"lastModified\":\"2025-08-06T16:36:19.350\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes\\nwas set, and the remote used encryption=pubkey or encryption=hybrid,\\nthe embedded AWS credentials were stored in the git repository\\nin (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919.\"},{\"lang\":\"es\",\"value\":\"git-annex ten\u00eda un error en los servidores remotos S3 y Glacier: si se configuraba embedcreds=yes y el servidor remoto usaba encrypted=pubkey o encrypted=hybrid, las credenciales de AWS integradas se almacenaban en el repositorio git en texto plano (en la pr\u00e1ctica), no cifradas como deb\u00edan. Este problema afecta a git-annex desde la versi\u00f3n 3.20121126 hasta la versi\u00f3n 5.20140919.\\n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-311\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git-annex_project:git-annex:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.20121126\",\"versionEndExcluding\":\"5.20140919\",\"matchCriteriaId\":\"C958D9B2-D59E-4F4D-AC0E-28D603D6AC93\"}]}]}],\"references\":[{\"url\":\"https://git-annex.branchable.com/upgrades/insecure_embedded_creds/\",\"source\":\"security@debian.org\",\"tags\":[\"Product\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-11-21T11:21:30+00:00",
      "cve": "CVE-2014-6274",
      "id": "CVE-2014-6274",
      "initial_release_date": "2014-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "git-annex: git-annex insufficent credential encryption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2014/cve-2014-6274.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2025-07-08T00:26:30Z",
      "cve": "CVE-2014-6274",
      "id": "CVE-2014-6274",
      "initial_release_date": "2025-06-28T00:01:55Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2014-6274",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2014-6274.json",
      "version": "4"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2014-6274\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-27T18:41:28.793228Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-311\", \"description\": \"CWE-311 Missing Encryption of Sensitive Data\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-27T18:41:16.692Z\"}}], \"cna\": {\"title\": \"S3 and Glacier remotes creds embedded in the git repo were not encrypted\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"affected\": [{\"vendor\": \"git-annex\", \"product\": \"git-annex\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.20121126\", \"lessThan\": \"5.20140919\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git-annex.branchable.com/upgrades/insecure_embedded_creds/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes\\nwas set, and the remote used encryption=pubkey or encryption=hybrid,\\nthe embedded AWS credentials were stored in the git repository\\nin (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003egit-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes\\nwas set, and the remote used encryption=pubkey or encryption=hybrid,\\nthe embedded AWS credentials were stored in the git repository\\nin (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919.\u003c/div\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"79363d38-fa19-49d1-9214-5f28da3f3ac5\", \"shortName\": \"debian\", \"dateUpdated\": \"2025-06-26T20:59:54.999Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2014-6274\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-27T18:41:32.782Z\", \"dateReserved\": \"2014-09-09T00:00:00.000Z\", \"assignerOrgId\": \"79363d38-fa19-49d1-9214-5f28da3f3ac5\", \"datePublished\": \"2025-06-26T20:59:54.999Z\", \"assignerShortName\": \"debian\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2014-6274

Vulnerability from fkie_nvd - Published: 2025-06-26 21:15 - Updated: 2026-06-17 00:12

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security@debian.org	https://git-annex.branchable.com/upgrades/insecure_embedded_creds/	Product

Impacted products

	Vendor	Product	Version
	git-annex_project	git-annex	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "git-annex",
          "vendor": "git-annex",
          "versions": [
            {
              "lessThan": "5.20140919",
              "status": "affected",
              "version": "3.20121126",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@debian.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:git-annex_project:git-annex:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C958D9B2-D59E-4F4D-AC0E-28D603D6AC93",
              "versionEndExcluding": "5.20140919",
              "versionStartIncluding": "3.20121126",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes\nwas set, and the remote used encryption=pubkey or encryption=hybrid,\nthe embedded AWS credentials were stored in the git repository\nin (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919."
    },
    {
      "lang": "es",
      "value": "git-annex ten\u00eda un error en los servidores remotos S3 y Glacier: si se configuraba embedcreds=yes y el servidor remoto usaba encrypted=pubkey o encrypted=hybrid, las credenciales de AWS integradas se almacenaban en el repositorio git en texto plano (en la pr\u00e1ctica), no cifradas como deb\u00edan. Este problema afecta a git-annex desde la versi\u00f3n 3.20121126 hasta la versi\u00f3n 5.20140919.\n"
    }
  ],
  "id": "CVE-2014-6274",
  "lastModified": "2026-06-17T00:12:49.177",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2014-6274",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-06-27T18:41:28.793228Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-06-26T21:15:27.647",
  "references": [
    {
      "source": "security@debian.org",
      "tags": [
        "Product"
      ],
      "url": "https://git-annex.branchable.com/upgrades/insecure_embedded_creds/"
    }
  ],
  "sourceIdentifier": "security@debian.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-311"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-PPJ6-RMFJ-4VJX

Vulnerability from github – Published: 2025-06-26 21:31 – Updated: 2025-06-27 21:30

Details

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2014-6274"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-311"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-26T21:15:27Z",
    "severity": "HIGH"
  },
  "details": "git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes\nwas set, and the remote used encryption=pubkey or encryption=hybrid,\nthe embedded AWS credentials were stored in the git repository\nin (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919.",
  "id": "GHSA-ppj6-rmfj-4vjx",
  "modified": "2025-06-27T21:30:27Z",
  "published": "2025-06-26T21:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6274"
    },
    {
      "type": "WEB",
      "url": "https://git-annex.branchable.com/upgrades/insecure_embedded_creds"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2014-6274

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2014-6274

Aliases

CVE-2014-6274

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2014-6274",
    "id": "GSD-2014-6274"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2014-6274"
      ],
      "id": "GSD-2014-6274",
      "modified": "2023-12-13T01:22:50.229252Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2014-6274",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

hsec-2023-0013

Vulnerability from osv_haskell

Published

2025-11-14 14:45

Modified

2025-11-14 14:45

Summary

git-annex plaintext storage of embedded credentials on encrypted remotes

Details

git-annex plaintext storage of embedded credentials on encrypted remotes

git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the Git repository in (effectively) plaintext, not encrypted as they were supposed to be.

That means that anyone who gets a copy of the Git repository can extract the AWS credentials from it. Which would be bad.

A remote with this problem cannot be enabled using git annex enableremote. Old versions of git-annex will fail with a GPG error; the current version will fail with a pointer to this web page.

Remediation

If your repository has this problem, chose from one of these approaches to deal with it:

Change your AWS credentials, so the ones stored in the clear in git won't be used.

After changing the credentials, make sure you have a fixed version of git-annex, and you can then re-embed the new creds into the repository, encrypted this time, by setting the AWS_SECRET_ACCESS_KEY and AWS_ACCESS_KEY_ID environment variables, and running git annex enableremote $remotename embedcreds=yes.

Fix the problem and then remove the history of the git-annex branch of the repository.

Make sure you have a fixed version of git-annex, and force git-annex to rewrite the embedded creds, with encryption this time, by setting by setting the AWS_SECRET_ACCESS_KEY and AWS_ACCESS_KEY_ID environment variables, and running git annex enableremote $remotename embedcreds=yes.

Then, to get rid of old versions of the git-annex branch that still contains the creds in cleartext, you can use git annex forget; note that it will remove other historical data too.

Keep in mind that this will not necessarily delete data from clones you do not control.

If you're sure that you're the only one who has access to the repository, you could decide to leave it as-is. It's no more insecure than if you had used encryption=shared in the first place when setting it up.

References

URL

Type

	https://git-annex.branchable.com/security/CVE-201…	ADVISORY
	https://git-annex.branchable.com/upgrades/insecur…	ARTICLE

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2023/HSEC-2023-0013.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2023/HSEC-2023-0013.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "git-annex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.20110401"
            },
            {
              "fixed": "5.20140919"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2014-6274"
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# *git-annex* plaintext storage of embedded credentials on encrypted remotes\n\n*git-annex* had a bug in the **S3** and **Glacier** remotes where if\n`embedcreds=yes` was set, and the remote used `encryption=pubkey` or\n`encryption=hybrid`, the embedded AWS credentials were stored in the\nGit repository in (effectively) plaintext, not encrypted as they\nwere supposed to be.\n\nThat means that anyone who gets a copy of the Git repository can\nextract the AWS credentials from it.  Which would be bad.\n\nA remote with this problem cannot be enabled using `git annex\nenableremote`. Old versions of *git-annex* will fail with a GPG\nerror; the current version will fail with a pointer to this web\npage.\n\n## Remediation\n\nIf your repository has this problem, chose from one of these\napproaches to deal with it:\n\n1. Change your AWS credentials, so the ones stored in the clear in\n   git won\u0027t be used.\n\n   After changing the credentials, make sure you have a fixed\n   version of git-annex, and you can then re-embed the new creds\n   into the repository, encrypted this time, by setting the\n   `AWS_SECRET_ACCESS_KEY` and `AWS_ACCESS_KEY_ID` environment\n   variables, and running `git annex enableremote $remotename\n   embedcreds=yes`.\n\n2. Fix the problem and then remove the history of the *git-annex*\n   branch of the repository.\n\n   Make sure you have a fixed version of *git-annex*, and force\n   *git-annex* to rewrite the embedded creds, with encryption this\n   time, by setting by setting the `AWS_SECRET_ACCESS_KEY` and\n   `AWS_ACCESS_KEY_ID` environment variables, and running `git annex\n   enableremote $remotename embedcreds=yes`.\n\n   Then, to get rid of old versions of the *git-annex* branch that\n   still contains the creds in cleartext, you can use `git annex\n   forget`; note that it will remove other historical data too.\n\n   Keep in mind that this will not necessarily delete data from\n   clones you do not control.\n\n3. If you\u0027re sure that you\u0027re the only one who has access to the\n   repository, you could decide to leave it as-is.  It\u0027s no more\n   insecure than if you had used `encryption=shared` in the first\n   place when setting it up.\n",
  "id": "HSEC-2023-0013",
  "modified": "2025-11-14T14:45:34Z",
  "published": "2025-11-14T14:45:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://git-annex.branchable.com/security/CVE-2014-6274/"
    },
    {
      "type": "ARTICLE",
      "url": "https://git-annex.branchable.com/upgrades/insecure_embedded_creds/"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "git-annex plaintext storage of embedded credentials on encrypted remotes"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2014-6274 (GCVE-0-2014-6274)

FKIE_CVE-2014-6274

GHSA-PPJ6-RMFJ-4VJX

GSD-2014-6274

hsec-2023-0013

Vulnerability from osv_haskell

git-annex plaintext storage of embedded credentials on encrypted remotes

Remediation

Tags

Sightings

Nomenclature

Related by attack behaviour