—

PYSEC-2017-6

Quick fix

PYSEC-2017-6 — attic: upgrade to the fixed version with the command below.

pip install --upgrade 'attic>=78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072'

Details

attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to "unencrypted / without key file".

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/attic

Introduced in: 0Fixed in: 78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072

Fixpip install --upgrade 'attic>=78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072'

References

https://github.com/jborg/attic/issues/271[REPORT]
https://github.com/jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072[FIX]
http://www.securityfocus.com/bid/74821[WEB]
http://www.openwall.com/lists/oss-security/2015/05/31/3[WEB]
https://github.com/advisories/GHSA-5x6q-ffwj-8vcf[ADVISORY]