Package: release.debian.org Severity: normal Tags: bullseye User: release.debian.org@packages.debian.org Usertags: pu X-Debbugs-Cc: team@security.debian.org The sabnzbdplus package has a security vulnerability, allowing a directory escape in the renamer() function through malicious par2 files. An attacker can create new files anywhere the privileges of the sabnzbdplus process permit, but not overwrite or delete existing files. The attached debdiff fixes the problem by backporting the upstream fix. Tested by downloading a proof-of-concept job designed to trigger the bug. All checks on salsa-ci also complete successfully, including the upstream testsuite used as autopkgtest. Upstream advisory: https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-jwj3-wrvf-v3rp Upstream fix: https://github.com/sabnzbd/sabnzbd/commit/3766ba54026eaa520dbee5b57a2f33d4954fb98b Security tracker (low severity/no-dsa): https://security-tracker.debian.org/tracker/CVE-2021-29488
Attachment:
sabnzbdplus_3.1.1+dfsg-2+deb11u1.debdiff
Description: Binary data
Attachment:
pgpvD_PYcBd3M.pgp
Description: OpenPGP digital signature