{"id":"openSUSE-SU-2023:0126-1","summary":"Security update for syncthing","details":"This update for syncthing fixes the following issues:\n\n- Update to 1.13.5\n\n  * This release fixes CVE-2022-46165 “Cross-site Scripting (XSS) in Web GUI”\n\n  * Bugfixes:\n\n    #8503: 'syncthing cli config devices add' reflect error when using --addresses flag\n    #8764: Ignore patterns creating during folder addition are not loaded\n    #8778: Tests fail on Windows with Go 1.20\n    #8779: Test cleanup fails all model tests on Windows on Go 1.20\n    #8859: Incorrect handling of path for auto accepted folder\n\n  * Other issues:\n\n    #8799: 'fatal error: checkptr: converted pointer straddles multiple allocations' in crypto tests\n\n- Update to 1.23.4\n\n  - Bugfixes:\n\n    #8851: 'Running global migration to fix encryption file sizes' on every start\n\n- Update to 1.23.3\n\n  * Bugfixes:\n\n    #5408: Selection of time in versions GUI not possible without editing the string inside the textfield\n    #8277: Mutual encrypted sharing doesn't work (both sides with password)\n    #8556: Increased file size when sharing between encrypted devices\n    #8599: Key generation at connect time is slow for encrypted connections\n\n  * Enhancements:\n\n    #7859: Allow sub-second watcher delay (use case: remote development)\n\n  * Other issues:\n\n    #8828: cmd/stdiscosrv: TestDatabaseGetSet flake\n\n- Adding a desktop file for the Web UI\n\n- Update to 1.23.2\n\n  * Bugfixes:\n\n    #8749: Relay listener does not restart sometimes\n\n  * Enhancements:\n\n    #8660: GUI editor for xattr filter patterns\n    #8781: gui: Remove duplicate Spanish translation\n\n  * Other issues:\n\n    #8768: Update quic-go for Go 1.20\n","modified":"2026-02-04T04:23:47.744356Z","published":"2023-06-12T14:01:56Z","related":["CVE-2022-46165"],"upstream":["CVE-2022-46165"],"references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FSIGQKHWF6QOVLGHNMHBJX6N46RVSK5D/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1212085"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-46165"}],"affected":[{"package":{"name":"syncthing","ecosystem":"SUSE:Package Hub 15 SP5","purl":"pkg:rpm/suse/syncthing&distro=SUSE%20Package%20Hub%2015%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.5-bp155.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"syncthing-relaysrv":"1.23.5-bp155.2.3.1","syncthing":"1.23.5-bp155.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0126-1.json"}},{"package":{"name":"syncthing","ecosystem":"openSUSE:Leap 15.5","purl":"pkg:rpm/opensuse/syncthing&distro=openSUSE%20Leap%2015.5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.5-bp155.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"syncthing-relaysrv":"1.23.5-bp155.2.3.1","syncthing":"1.23.5-bp155.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0126-1.json"}}],"schema_version":"1.7.3"}