{"id":"CVE-2017-8805","details":"Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal attacks via a crafted upstream mirror.","modified":"2026-07-08T05:50:33.477564458Z","published":"2017-10-17T18:29:00.247Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"last_affected":"20171016"}],"source":"CPE_RANGE","vendor_product":"debian:ftpsync","cpes":["cpe:2.3:a:debian:ftpsync:*:*:*:*:*:*:*:*"]}]},"references":[{"type":"REPORT","url":"https://lists.debian.org/debian-mirrors/2017/10/msg00017.html"},{"type":"FIX","url":"http://www.openwall.com/lists/oss-security/2017/10/17/2"},{"type":"FIX","url":"https://anonscm.debian.org/cgit/mirror/archvsync.git/commit/?id=d1ca2ab2210990b6dfb664cd6776a41b71c48016"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://salsa.debian.org/mirror-team/archvsync","events":[{"introduced":"0"},{"fixed":"b38fdfe444e79aea9cdcae9623f9dbce11416f96"}],"database_specific":{"source":"DESCRIPTION","extracted_events":[{"introduced":"0"},{"fixed":"20171017"}]}}],"versions":["20170920","20170912","20170810","20170204","20160306","20150425","20130605","20130501","20120521","80486","80387","80386","80286","8086","4711","0815","23","42","3.1415926"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8805.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}