openSUSE-SU-2023:0126-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0126-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2023:0126-1
Upstream
Related
Published
2023-06-12T14:01:56Z
Modified
2026-02-04T04:23:47Z
Summary
Security update for syncthing
Details

This update for syncthing fixes the following issues:

  • Update to 1.13.5

    • This release fixes CVE-2022-46165 “Cross-site Scripting (XSS) in Web GUI”

    • Bugfixes:

      #8503: 'syncthing cli config devices add' reflect error when using --addresses flag #8764: Ignore patterns creating during folder addition are not loaded #8778: Tests fail on Windows with Go 1.20 #8779: Test cleanup fails all model tests on Windows on Go 1.20 #8859: Incorrect handling of path for auto accepted folder

    • Other issues:

      #8799: 'fatal error: checkptr: converted pointer straddles multiple allocations' in crypto tests

  • Update to 1.23.4

    • Bugfixes:

      #8851: 'Running global migration to fix encryption file sizes' on every start

  • Update to 1.23.3

    • Bugfixes:

      #5408: Selection of time in versions GUI not possible without editing the string inside the textfield #8277: Mutual encrypted sharing doesn't work (both sides with password) #8556: Increased file size when sharing between encrypted devices #8599: Key generation at connect time is slow for encrypted connections

    • Enhancements:

      #7859: Allow sub-second watcher delay (use case: remote development)

    • Other issues:

      #8828: cmd/stdiscosrv: TestDatabaseGetSet flake

  • Adding a desktop file for the Web UI

  • Update to 1.23.2

    • Bugfixes:

      #8749: Relay listener does not restart sometimes

    • Enhancements:

      #8660: GUI editor for xattr filter patterns #8781: gui: Remove duplicate Spanish translation

    • Other issues:

      #8768: Update quic-go for Go 1.20

References

Affected packages

SUSE:Package Hub 15 SP5 / syncthing

Package

Name
syncthing
Purl
pkg:rpm/suse/syncthing&distro=SUSE%20Package%20Hub%2015%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.23.5-bp155.2.3.1

Ecosystem specific 

{
    "binaries":  [
        {
            "syncthing":  "1.23.5-bp155.2.3.1",
            "syncthing-relaysrv":  "1.23.5-bp155.2.3.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0126-1.json"

openSUSE:Leap 15.5 / syncthing

Package

Name
syncthing
Purl
pkg:rpm/opensuse/syncthing&distro=openSUSE%20Leap%2015.5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.23.5-bp155.2.3.1

Ecosystem specific 

{
    "binaries":  [
        {
            "syncthing":  "1.23.5-bp155.2.3.1",
            "syncthing-relaysrv":  "1.23.5-bp155.2.3.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0126-1.json"