Bug 639102 (CVE-2017-15914)

Summary:	<app-backup/borgbackup-1.1.3: repository access control bypass over SSH
Product:	Gentoo Security	Reporter:	Michael Orlitzky <mjo>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	blueness, kfm
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://dev.solus-project.com/D1463
Whiteboard:	B2 [noglsa cve]
Package list:		Runtime testing required:	---

Description Michael Orlitzky gentoo-dev

2017-11-28 19:57:54 UTC

From the 1.1.3 ChangeLog,

Security Fix for CVE-2017-15914: Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers. A user able to access a remote Borg SSH server is able to circumvent access controls post-authentication. Affected releases: 1.1.0, 1.1.1, 1.1.2. Releases 1.0.x are NOT affected.

The fixed version is already in the tree but will need an amd64 stabilization.

Comment 1 Anthony Basile gentoo-dev

2017-11-30 20:07:33 UTC

okay i just stabilized 1.1.3 and removed all vulnerable versions.

Comment 2 Aaron Bauman (RETIRED) gentoo-dev

2018-01-23 02:45:10 UTC

(In reply to Anthony Basile from comment #1)
> okay i just stabilized 1.1.3 and removed all vulnerable versions.

Sorry for the delay, Anthony.  

Downgrading to B3.  Ambiguous "access control" details from upstream and no PoC for ACE/RCE.

Tree is clean.