ocaml-opam -- opam install sandbox escape using symlinks

The OCaml Team reports: Installing files through .install files do not check symlinks resolution of the target path, and so can bypass sandboxing. Credits: Reporter: "Kate Deplaix" Remediation Developer: "Nathan Rebours" Remediation Reviewer: "Raja Boujbel" Coordinator: "Hannes Mehnert"...