From 4d177318cb45c368c213f4e155ee23f16d921789 Mon Sep 17 00:00:00 2001 From: Ashish SHUKLA Date: Wed, 9 Jun 2021 01:00:08 +0530 Subject: security/vuxml: Document CVE-2021-33896 in net-im/dino port --- security/vuxml/vuln.xml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) (limited to 'security/vuxml') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 3addf0844167..302695f30df4 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -76,6 +76,37 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + dino -- Path traversal in Dino file transfers + + + dino + 0.2.1 + + + + +

Dino team reports:

+
It was discovered that when a user receives and downloads + a file in Dino, URI-encoded path separators in the file name + will be decoded, allowing an attacker to traverse + directories and create arbitrary files in the context of the + user.
+

+ + + + CVE-2021-33896 + https://marc.info/?l=oss-security&m=162308719412719 + https://dino.im/security/cve-2021-33896/ + + + 2021-06-07 + 2021-06-08 + + + pglogical -- shell command injection in pglogical.create_subscription() -- cgit v1.2.3