openSUSE-SU-2023:0126-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0126-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2023:0126-1
Related
Published
2023-06-12T14:01:56Z
Modified
2023-06-12T14:01:56Z
Summary
Security update for syncthing
Details

This update for syncthing fixes the following issues:

  • Update to 1.13.5

    • This release fixes CVE-2022-46165 “Cross-site Scripting (XSS) in Web GUI”

    • Bugfixes:

      8503: 'syncthing cli config devices add' reflect error when using --addresses flag

      8764: Ignore patterns creating during folder addition are not loaded

      8778: Tests fail on Windows with Go 1.20

      8779: Test cleanup fails all model tests on Windows on Go 1.20

      8859: Incorrect handling of path for auto accepted folder

    • Other issues:

      8799: 'fatal error: checkptr: converted pointer straddles multiple allocations' in crypto tests

  • Update to 1.23.4

    • Bugfixes:

      8851: 'Running global migration to fix encryption file sizes' on every start

  • Update to 1.23.3

    • Bugfixes:

      5408: Selection of time in versions GUI not possible without editing the string inside the textfield

      8277: Mutual encrypted sharing doesn't work (both sides with password)

      8556: Increased file size when sharing between encrypted devices

      8599: Key generation at connect time is slow for encrypted connections

    • Enhancements:

      7859: Allow sub-second watcher delay (use case: remote development)

    • Other issues:

      8828: cmd/stdiscosrv: TestDatabaseGetSet flake

  • Adding a desktop file for the Web UI

  • Update to 1.23.2

    • Bugfixes:

      8749: Relay listener does not restart sometimes

    • Enhancements:

      8660: GUI editor for xattr filter patterns

      8781: gui: Remove duplicate Spanish translation

    • Other issues:

      8768: Update quic-go for Go 1.20

References

Affected packages

SUSE:Package Hub 15 SP5 / syncthing

Package

Name
syncthing
Purl
purl:rpm/suse/syncthing&distro=SUSE%20Package%20Hub%2015%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.23.5-bp155.2.3.1

Ecosystem specific

{
    "binaries": [
        {
            "syncthing": "1.23.5-bp155.2.3.1",
            "syncthing-relaysrv": "1.23.5-bp155.2.3.1"
        }
    ]
}

openSUSE:Leap 15.5 / syncthing

Package

Name
syncthing
Purl
purl:rpm/suse/syncthing&distro=openSUSE%20Leap%2015.5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.23.5-bp155.2.3.1

Ecosystem specific

{
    "binaries": [
        {
            "syncthing": "1.23.5-bp155.2.3.1",
            "syncthing-relaysrv": "1.23.5-bp155.2.3.1"
        }
    ]
}