Update Info

openSUSE-2023-126


Security update for syncthing


Type: security
Severity: moderate
Issued: 2023-06-12
Description:
This update for syncthing fixes the following issues:

- Update to 1.13.5

  * This release fixes CVE-2022-46165 “Cross-site Scripting (XSS) in Web GUI”

  * Bugfixes:

    #8503: "syncthing cli config devices add" reflect error when using --addresses flag
    #8764: Ignore patterns creating during folder addition are not loaded
    #8778: Tests fail on Windows with Go 1.20
    #8779: Test cleanup fails all model tests on Windows on Go 1.20
    #8859: Incorrect handling of path for auto accepted folder

  * Other issues:

    #8799: "fatal error: checkptr: converted pointer straddles multiple allocations" in crypto tests

- Update to 1.23.4

  - Bugfixes:

    #8851: "Running global migration to fix encryption file sizes" on every start

- Update to 1.23.3

  * Bugfixes:

    #5408: Selection of time in versions GUI not possible without editing the string inside the textfield
    #8277: Mutual encrypted sharing doesn't work (both sides with password)
    #8556: Increased file size when sharing between encrypted devices
    #8599: Key generation at connect time is slow for encrypted connections

  * Enhancements:

    #7859: Allow sub-second watcher delay (use case: remote development)

  * Other issues:

    #8828: cmd/stdiscosrv: TestDatabaseGetSet flake

- Adding a desktop file for the Web UI

- Update to 1.23.2

  * Bugfixes:

    #8749: Relay listener does not restart sometimes

  * Enhancements:

    #8660: GUI editor for xattr filter patterns
    #8781: gui: Remove duplicate Spanish translation

  * Other issues:

    #8768: Update quic-go for Go 1.20


              

Packages


  • syncthing-1.23.5-bp155.2.3.1