Description
proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a crafted restore archive to copy files between otherwise isolated containers. This issue is fixed in version 5.1.6.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| termux | proot-distro | < 5.1.6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | proot-distro | < 5.1.6 | 5.1.6 | GHSA-7h3g-4w2f-fj2f |