Package: release.debian.org Severity: normal Tags: bullseye User: release.debian....@packages.debian.org Usertags: pu X-Debbugs-Cc: t...@security.debian.org
The sabnzbdplus package has a security vulnerability, allowing a directory escape in the renamer() function through malicious par2 files. An attacker can create new files anywhere the privileges of the sabnzbdplus process permit, but not overwrite or delete existing files. The attached debdiff fixes the problem by backporting the upstream fix. Tested by downloading a proof-of-concept job designed to trigger the bug. All checks on salsa-ci also complete successfully, including the upstream testsuite used as autopkgtest. Upstream advisory: https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-jwj3-wrvf-v3rp Upstream fix: https://github.com/sabnzbd/sabnzbd/commit/3766ba54026eaa520dbee5b57a2f33d4954fb98b Security tracker (low severity/no-dsa): https://security-tracker.debian.org/tracker/CVE-2021-29488
sabnzbdplus_3.1.1+dfsg-2+deb11u1.debdiff
Description: Binary data
pgpK0lHp21EfV.pgp
Description: OpenPGP digital signature
