{"action":"Upgrade git-annex to 6.20180626-1 or later.","affected":[{"fixed":"6.20180626-1","introduced":"0"}],"component":"git-annex","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["6.20180626-1"],"id":"tcs_01M5NCWV8D7SJP5MPKC68VC2GV","modified_at":"2026-10-23T18:01:43.307140321Z","published_at":"2018-07-16T18:29:00.227Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2018-10859","https://security-tracker.debian.org/tracker/CVE-2018-10859"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2018-10859#Debian:14/git-annex","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2018-10859"}],"summary":"git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key."}