CVE-2008-2780: The Anubis (aka Anubis+Ripe160) plugin before 1.3 for encrypt stores the unencrypted file's size in clearte...

Security readout for executives and security teams

This is a narrow confidentiality issue in an old Anubis encryption plugin. Versions before 1.3 store the original unencrypted file size in cleartext inside the encrypted file header. That can reveal file-size metadata and help separate real encrypted content from padding, but the sources do not show plaintext recovery or code execution. Exposure is likely limited to legacy systems still using the encrypt utility with the Anubis or Anubis+Ripe160 plugin before version 1.3. The source bundle does not identify modern packages, CPEs, operating systems, or deployment prevalence. Treat this as low urgency unless the organization depends on this legacy plugin to protect highly sensitive file-size patterns. Prioritize inventory and migration over emergency response, because the cited impact is limited and no active exploitation is documented. Mitigation focus: Identify any use of encrypt with the Anubis or Anubis+Ripe160 plugin.; Upgrade the Anubis plugin to version 1.3 or later where applicable.; Check original vendor guidance if legacy copies or forks are still deployed..

Prepared

Jun 28, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.