{"affected":[{"ecosystem_specific":{"binaries":[{"syncthing":"1.23.5-bp155.2.3.1","syncthing-relaysrv":"1.23.5-bp155.2.3.1"}]},"package":{"ecosystem":"SUSE:Package Hub 15 SP5","name":"syncthing","purl":"purl:rpm/suse/syncthing&distro=SUSE%20Package%20Hub%2015%20SP5"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.23.5-bp155.2.3.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"syncthing":"1.23.5-bp155.2.3.1","syncthing-relaysrv":"1.23.5-bp155.2.3.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.5","name":"syncthing","purl":"purl:rpm/suse/syncthing&distro=openSUSE%20Leap%2015.5"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.23.5-bp155.2.3.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for syncthing fixes the following issues:\n\n- Update to 1.13.5\n\n  * This release fixes CVE-2022-46165 “Cross-site Scripting (XSS) in Web GUI”\n\n  * Bugfixes:\n\n    #8503: 'syncthing cli config devices add' reflect error when using --addresses flag\n    #8764: Ignore patterns creating during folder addition are not loaded\n    #8778: Tests fail on Windows with Go 1.20\n    #8779: Test cleanup fails all model tests on Windows on Go 1.20\n    #8859: Incorrect handling of path for auto accepted folder\n\n  * Other issues:\n\n    #8799: 'fatal error: checkptr: converted pointer straddles multiple allocations' in crypto tests\n\n- Update to 1.23.4\n\n  - Bugfixes:\n\n    #8851: 'Running global migration to fix encryption file sizes' on every start\n\n- Update to 1.23.3\n\n  * Bugfixes:\n\n    #5408: Selection of time in versions GUI not possible without editing the string inside the textfield\n    #8277: Mutual encrypted sharing doesn't work (both sides with password)\n    #8556: Increased file size when sharing between encrypted devices\n    #8599: Key generation at connect time is slow for encrypted connections\n\n  * Enhancements:\n\n    #7859: Allow sub-second watcher delay (use case: remote development)\n\n  * Other issues:\n\n    #8828: cmd/stdiscosrv: TestDatabaseGetSet flake\n\n- Adding a desktop file for the Web UI\n\n- Update to 1.23.2\n\n  * Bugfixes:\n\n    #8749: Relay listener does not restart sometimes\n\n  * Enhancements:\n\n    #8660: GUI editor for xattr filter patterns\n    #8781: gui: Remove duplicate Spanish translation\n\n  * Other issues:\n\n    #8768: Update quic-go for Go 1.20\n","id":"openSUSE-SU-2023:0126-1","modified":"2023-06-12T14:01:56Z","published":"2023-06-12T14:01:56Z","references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FSIGQKHWF6QOVLGHNMHBJX6N46RVSK5D/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1212085"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-46165"}],"related":["CVE-2022-46165"],"summary":"Security update for syncthing"}