CVE-2015-4082

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-08-18 · updated 2026-06-17
Weakness: CWE-264

Description

attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to "unencrypted / without key file".

Affected products

Attic Project Attic: through 0.14

References

http://www.openwall.com/lists/oss-security/2015/05/31/3
http://www.securityfocus.com/bid/74821
https://github.com/jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072
https://github.com/jborg/attic/issues/271
http://www.openwall.com/lists/oss-security/2015/05/31/3
http://www.securityfocus.com/bid/74821
https://github.com/jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072
https://github.com/jborg/attic/issues/271

Get alerted when CVE-2015-4082 or the next vulnerability affects your stack