{"action":"Upgrade attic to 0.15 or later.","affected":[{"fixed":"0.15","introduced":"0"}],"component":"attic","cve_ids":["CVE-2015-4082"],"ecosystem":"PyPI","epss":0.02486,"exploited":false,"fixed_versions":["0.15"],"ghsa_id":"GHSA-5x6q-ffwj-8vcf","id":"tcs_01M5KG7DBBS6GNE2DH23BTHF4P","modified_at":"2026-06-10T17:00:35.565768303Z","published_at":"2017-08-18T16:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-6","https://github.com/jborg/attic/issues/271","https://github.com/jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072","http://www.securityfocus.com/bid/74821","http://www.openwall.com/lists/oss-security/2015/05/31/3","https://github.com/advisories/GHSA-5x6q-ffwj-8vcf"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2017-6","url":"https://osv.dev/vulnerability/PYSEC-2017-6"}],"summary":"attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive informat"}