v5.12.2 Patch Fixes 5 CVEs: Path Traversal, Symlink Escape, Unauth N/A

Vulnerability Overview The provided webpage screenshot displays security patches for version , which address 5 CVE vulnerabilities. These vulnerabilities affect the , , and modules. Affected Scope GHSA-6x2m-p4xp-wrg2 (Moderate): Symlink escape vulnerability in . GHSA-48v2-6pr9-2jif (Moderate): Backup ID path traversal vulnerability in . GHSA-2fnp-9vwx-hc96 (High): Arbitrary recursive deletion vulnerability in backup manifests. GHSA-jvcm-f35g-w78p (Moderate): Sandbox path prefix bypass vulnerability in . GHSA-mxjx-2bvx-xjjj (Moderate): Unauthenticated HTTP server vulnerability in . Remediation 1. GHSA-6x2m-p4xp-wrg2: - now uses and skips entries where returns . Symbolic links are never followed, preventing file reads from outside the environment. 2. GHSA-48v2-6pr9-2jif: - validates the backup ID, rejecting IDs resembling or . 3. GHSA-2fnp-9vwx-hc96: - no longer uses for deletion from the manifest. The deletion path is recalculated from . After format validation, a check enforces a limit to one level deeper than the backup directory. Entries with in the manifest are now harmless. 4. GHSA-jvcm-f35g-w78p: - and now use a prefix check ( ). The previous naked check allowed to match . 5. GHSA-mxjx-2bvx-xjjj: - A new option has been added to . When set, and require the header . Validation uses to prevent timing oracle attacks. continues to default to (localhost only). Other Changes The version has been upgraded from to , and all manifests and documentation headers have been updated. When upgrading from , the option for is optional; existing deployments without a continue to work (backward compatible but unauthenticated). Set the for any instance exposed to the network. Code Block Summary This security patch addresses multiple critical vulnerabilities, including symlink escape, path traversal, arbitrary recursive deletion, sandbox path prefix bypass, and an unauthenticated HTTP server. The remediation strategies include validating backup IDs, restricting deletion path depth, using prefix checks, and adding an authentication option.

Goal Reached Thanks to every supporter — we hit 100%!

v5.12.2 Patch Fixes 5 CVEs: Path Traversal, Symlink Escape, Unauth N/A

More from this source