openSUSE Build Service

Overview Details Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo (Revision 82ddc74a58a0e41e8425e4fcd3d0cf0e)

Currently displaying revision 82ddc74a58a0e41e8425e4fcd3d0cf0e , Show latest

<patchinfo incident="6091">
  <issue id="1016161" tracker="bnc">VUL-0: syncthing: two vulnerabilities fixed in 0.14.14</issue>
  <category>security</category>
  <rating>moderate</rating>
  <packager>XRevan86</packager>
  <description>
This updates syncthing to version 0.14.16 and fixes the following issues:

- security issues have been fixed:

* A remote device that was already accepted by syncthing could perform
  arbitrary reads and writes outside of the configured directories
  (boo#1016161) by using:

- index entries for files like '../../foo', thus resulting in a path above
    the configured directory.
    - creating a symlink 'foo -&gt; ../../' and then requesting the
    contents of 'foo/something'

Syncing symlinks between v0.14.14+ and previous versions will not work.

- syncthing was updated to version 0.14.15 (changes since 0.14.13):
  * The wording in the GUI around "last file received" is now
    clearer (gh#syncthing/syncthing#3769).
- Fix Go 1.6 and older compatibility.

- Update to version 0.14.13:
  * Improve CPU usage when scanning (gh#syncthing/syncthing#3394).
  * Fix writing config and .stignore files on filesystems without
    chmod support (gh#syncthing/syncthing#2472).
  * Language selector now stays above the bottom bar
    (gh#syncthing/syncthing#3758).

- Update to version 0.14.12:
  * A data race in the code that caused test failures, and possibly
    other inconsitencies, has been resolved
    (gh#syncthing/syncthing#3737).
  * Links in warning messages are now clickable in the GUI
    (gh#syncthing/syncthing#3241).
  * Files are now synced to the drive before committed to database,
    to avoid possible inconsistencies if a power failure occurs
    during syncing (gh#syncthing/syncthing#3711).
  * Log entries now mention directories by label in addition to the
    ID (gh#syncthing/syncthing#3724).
  * The default directory now has the directory ID "default" again,
    simplifying initial setup.
  * Retries for misconfigured relay setups are slowed down somewhat
    to be kinder on our relay pool infrastructure.

- Update to version 0.14.11 (changes since 0.14.9):
  * Display of global and local state is clearer, especially in the
    presence of ignores (gh#syncthing/syncthing#3623).
  * GUI does not show "failed items" unless there are items that
    have failed (gh#syncthing/syncthing#3647).
  * Introducers can now remove devices that they introduced
    (gh#syncthing/syncthing#1015).
  * Syncthing now correctly reconnects to staticly configured
    relays (gh#syncthing/syncthing#3726).
  * strelaysrv: No longer crash with 'panic: send on closed channel'
    (gh#syncthing/syncthing#3718).
  * strelaysrv: Binding to a specific address now works better
    (gh#syncthing/syncthing#3682).
  * Directory information in the GUI now uses icons and tooltips
    (gh#syncthing/syncthing#3710).
  * Fixes to questionmark and asterisk handling in ignore patterns.
  * Re-add the "Black" theme.
</description>
  <summary>Security update for syncthing</summary>
</patchinfo>

Places

File _patchinfo of Package patchinfo (Revision 82ddc74a58a0e41e8425e4fcd3d0cf0e)

Places