GHSA-8FJR-HGHR-4M99 Archive spoofing vulnerability in borgbackup

🗓️ 30 Aug 2023 20:09:33Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Archive spoofing in borgbackup allows fake archives with write access; fixes in pre 1.2.5 and 1.2.6; upgrade and verify after repair.

Reporter	Title	Published	Views	Family All 35
AlpineLinux	CVE-2023-36811	30 Aug 202317:32	–	alpinelinux
FreeBSD	Borg (Backup) -- flaw in cryptographic authentication scheme in Borg allowed an attacker to fake archives and indirectly cause backup data loss.	13 Jun 202300:00	–	freebsd
Circl	CVE-2023-36811	30 Aug 202322:12	–	circl
CNNVD	BorgBackup 数据伪造问题漏洞	30 Aug 202300:00	–	cnnvd
CVE	CVE-2023-36811	30 Aug 202317:32	–	cve
Cvelist	CVE-2023-36811 Archive spoofing vulnerability in borgbackup	30 Aug 202317:32	–	cvelist
Debian CVE	CVE-2023-36811	30 Aug 202317:32	–	debiancve
EUVD	EUVD-2023-0050	3 Oct 202520:07	–	euvd
Fedora	[SECURITY] Fedora 38 Update: borgbackup-1.2.6-1.fc38	15 Sep 202301:42	–	fedora
Fedora	[SECURITY] Fedora 37 Update: borgbackup-1.2.6-1.fc37	15 Sep 202301:35	–	fedora

Source	Link
github	www.github.com/borgbackup/borg/security/advisories/GHSA-8fjr-hghr-4m99
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-36811
github	www.github.com/borgbackup/borg/commit/3eb070191da10c2d3f7bc6484cf3d51c3045f884
github	www.github.com/borgbackup/borg
github	www.github.com/borgbackup/borg/blob/1.2.5-cvedocs/docs/changes.rst
github	www.github.com/borgbackup/borg/blob/1.2.6/docs/changes.rst
github	www.github.com/pypa/advisory-database/tree/main/vulns/borgbackup/PYSEC-2023-164.yaml
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/5Q3OHXERTU547SEQ3YREZXHOCYNLVD63
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/XOZDFIYEBIOKSIEAXUJJJFUJTAJ7TF3C
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/ZUCQSMAWOJBCRGF6XPKEZ2TPGAPNKIWV

13 Sep 2024 15:06Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.7

CVSS 46

EPSS0.00106