FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2025-02-13 20:06:50 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
b8a52e5a-483d-11ee-971d-3df00e0f9020	Borg (Backup) -- flaw in cryptographic authentication scheme in Borg allowed an attacker to fake archives and indirectly cause backup data loss. Thomas Waldmann reports: A flaw in the cryptographic authentication scheme in Borg allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository. The attack requires an attacker to be able to insert files (with no additional headers) into backups gain write access to the repository This vulnerability does not disclose plaintext to the attacker, nor does it affect the authenticity of existing archives. Creating plausible fake archives may be feasible for empty or small archives, but is unlikely for large archives. Discovery 2023-06-13 Entry 2023-08-31 py37-borgbackup py38-borgbackup py39-borgbackup py310-borgbackup py311-borgbackup py312-borgbackup < 1.2.5 CVE-2023-36811 https://github.com/borgbackup/borg/blob/1.2.5-cvedocs/docs/changes.rst#pre-125-archives-spoofing-vulnerability-cve-2023-36811

VuXML ID

Description

b8a52e5a-483d-11ee-971d-3df00e0f9020

Borg (Backup) -- flaw in cryptographic authentication scheme in Borg allowed an attacker to fake archives and indirectly cause backup data loss.

Thomas Waldmann reports:

A flaw in the cryptographic authentication scheme in Borg allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository.

The attack requires an attacker to be able to

insert files (with no additional headers) into backups

gain write access to the repository

This vulnerability does not disclose plaintext to the attacker, nor does it affect the authenticity of existing archives. Creating plausible fake archives may be feasible for empty or small archives, but is unlikely for large archives.

Discovery 2023-06-13
Entry 2023-08-31
py37-borgbackup
py38-borgbackup
py39-borgbackup
py310-borgbackup
py311-borgbackup
py312-borgbackup

< 1.2.5

CVE-2023-36811
https://github.com/borgbackup/borg/blob/1.2.5-cvedocs/docs/changes.rst#pre-125-archives-spoofing-vulnerability-cve-2023-36811