attic has improper verification of unencrypted backups

published 2017-08-18 9 y ago modified 2026-06-17 4 mo ago also GHSA-5x6q-ffwj-8vcf , PYSEC-2017-6 , EUVD-2017-0012

cvss: 6.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.5%; EPSS 2.5% chance of exploitation in 30 days, percentile 85%
public exploits: 0; none known

attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to "unencrypted / without key file".

Patch / fix

fixed in 1 distros 1 links 1

pypi attic 0.15

attic Ubuntu Pro 14.04 LTS 0.10-1.1ubuntu0.1+esm1

ubuntu advisories UBUNTU-CVE-2015-4082

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

github.com/jborg/attic@78f9ad1 commit

Exploit prediction

2.54% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

github.com https://github.com/jborg/attic/issues/271 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	attic	<0.15	0.15

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

github.com /jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072
web, third-party-advisory, patch
github.com /jborg/attic/issues/271
web, exploit, third-party-advisory, report
openwall.com /lists/oss-security/2015/05/31/3
mailing-list, web, third-party-advisory
securityfocus.com /bid/74821
vdb-entry, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2015-4082
advisory
github.com /jborg/attic
package
github.com /pypa/advisory-database/tree/main/vulns/attic/PYSEC-2017-6.yaml
web
web.archive.org /web/20200517225455/http://www.securityfocus.com/bid/74821
web
github.com /advisories/GHSA-5x6q-ffwj-8vcf
advisory

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary