CVE-2017-8805 Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal attacks via a crafted upstream mirror.
CriticalCVSS 9.1
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal attacks via a crafted upstream mirror.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/archvsync(Debian:12) | < 20171017 | 20171017 |
| debian/archvsync(Debian:13) | < 20171017 | 20171017 |
| debian/archvsync(Debian:14) | < 20171017 | 20171017 |
| debian ftpsync | <= 20171016 | No fix listed |
References
- Debian Security Tracker CVE-2017-8805 vendor-advisory
- www.openwall.com issue-tracking mailing-list patch third-party-advisory
- anonscm.debian.org issue-tracking patch vendor-advisory
- lists.debian.org issue-tracking mailing-list vendor-advisory