[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#993035: bullseye-pu: package sabnzbdplus/3.1.1+dfsg-2



Package: release.debian.org
Severity: normal
Tags: bullseye
User: release.debian.org@packages.debian.org
Usertags: pu
X-Debbugs-Cc: team@security.debian.org

The sabnzbdplus package has a security vulnerability, allowing a
directory escape in the renamer() function through malicious par2 files.

An attacker can create new files anywhere the privileges of the
sabnzbdplus process permit, but not overwrite or delete existing files.

The attached debdiff fixes the problem by backporting the upstream fix.

Tested by downloading a proof-of-concept job designed to trigger the bug.
All checks on salsa-ci also complete successfully, including the upstream
testsuite used as autopkgtest.

Upstream advisory:
https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-jwj3-wrvf-v3rp
Upstream fix:
https://github.com/sabnzbd/sabnzbd/commit/3766ba54026eaa520dbee5b57a2f33d4954fb98b
Security tracker (low severity/no-dsa):
https://security-tracker.debian.org/tracker/CVE-2021-29488

Attachment: sabnzbdplus_3.1.1+dfsg-2+deb11u1.debdiff
Description: Binary data

Attachment: pgpvD_PYcBd3M.pgp
Description: OpenPGP digital signature


Reply to: