Description
Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dino-im | 0.2.0-3 | — |
| Debian 13 | dino-im | 0.2.0-3 | — |
| Debian 12 | dino-im | 0.2.0-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | dino-im | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | dino-im | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | dino | 0.2.1-r0 | — |
| Alpine v3.23 | dino | 0.2.1-r0 | — |
| Alpine v3.22 | dino | 0.2.1-r0 | — |
| Alpine v3.21 | dino | 0.2.1-r0 | — |
| Alpine v3.20 | dino | 0.2.1-r0 | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | dino | 0.2.1-r0 | — |
| Alpine v3.18 | dino | 0.2.1-r0 | — |
| Alpine v3.17 | dino | 0.2.1-r0 | — |
| Alpine v3.16 | dino | 0.2.1-r0 | — |
| Alpine v3.15 | dino | 0.2.1-r0 | — |
| Alpine v3.14 | dino | 0.2.1-r0 | — |
| Alpine v3.13 | dino | 0.2.1-r0 | — |
References
- https://dino.im/blog/
- https://dino.im/security/cve-2021-33896/
- [oss-security] 20210607 [CVE-2021-33896] Path traversal in Dino file transfers mailing-list
- FEDORA-2021-3cf08ffe38 vendor-advisory
- FEDORA-2021-d5d263ec35 vendor-advisory