Homepage

borgbackup@1.1.4 vulnerabilities

Deduplicated, encrypted, authenticated and compressed backups

  • latest version

    1.4.0

  • latest non vulnerable version

    2.0.0b14

  • first published

    9 years ago

  • latest version published

    5 months ago

  • licenses detected

  • View borgbackup package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the borgbackup package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Improper Authorization

    Affected versions of this package are vulnerable to Improper Authorization due to allowing an attacker to access a mount with -o uid=1001,umask=077 as user 1000.

    How to fix Improper Authorization?

    Upgrade borgbackup to version 1.1.9 or higher.

    [,1.1.9)
    • M
    Cryptographic Operations are run Before Supporting Units are Ready

    Affected versions of this package are vulnerable to Cryptographic Operations are run Before Supporting Units are Ready due to a flaw in the cryptographic authentication scheme. An attacker can fake archives and potentially indirectly cause backup data loss in the repository by inserting files (with no additional headers) into backups and gaining write access to the repository.

    Note:

    Data loss after being attacked can be avoided by reviewing the archives (timestamp and contents valid and as expected) after any "borg check --repair" and before "borg prune".

    How to fix Cryptographic Operations are run Before Supporting Units are Ready?

    Upgrade borgbackup to version 1.2.5 or higher.

    [,1.2.5)
    Go back to all versions of this package