Описание
Syncthing vulnerable to symlink traversal and arbitrary file overwrite
Syncthing version 0.14.33 and older erronously versions symlinks when they are deleted. If a directory is then created with the same name, a file created in that directory, and the file deleted, it is moved into the symlink target. This can lead to symlink traversal resulting in arbitrary file overwrite.
Пакеты
github.com/syncthing/syncthing
<= 0.14.33
Отсутствует
Связанные уязвимости
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
Syncthing version 0.14.33 and older is vulnerable to symlink traversal ...
ALT-PU-2017-2004: package `syncthing` update to version 0.14.35-alt1