Skip to content
OpenAdvisories
Medium · 4.3 CVE-2021-29488 EUVD-2021-16087

Creation of files outside the Download Folder through malicious PAR2 files

Published May 7, 2021 · Updated Aug 3, 2024 · Assigned by GitHub_M

Description

SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function into writing downloaded files outside the configured Download Folder via malicious PAR2 files. A patch was released as part of SABnzbd 3.2.1RC1. As a workaround, limit downloads to NZBs without PAR2 files, deny write permissions to the SABnzbd process outside areas it must access to perform its job, or update to a fixed version.

Affected products

VendorProductAffectedFixed
sabnzbd sabnzbd < 3.0.0, < 3.2.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 sabnzbdplus 3.2.1+dfsg-1 —
Debian 13 sabnzbdplus 3.2.1+dfsg-1 —
Debian 12 sabnzbdplus 3.2.1+dfsg-1 —
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS sabnzbdplus No fix yet —
Ubuntu 20.04 LTS sabnzbdplus No fix yet —
Ubuntu 18.04 LTS sabnzbdplus No fix yet —
Ubuntu 16.04 LTS sabnzbdplus No fix yet —

References