Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:shellinabox User: [email protected] Usertags: pu
shellinabox 2.21+deb13u1 fixes security defect #1153131, an ineffective directory traversal guard. [ Reason ] The --static-file option fails to detect path segments including '..', enabling access to resources outside the hierarchy intended by the user starting the service. This bug has been present in all versions of the package in Debian except for 2.21+really2.21-3, which fixes this bug in sid. [ Impact ] Unintended access to files for users of shellinabox in trixie who use this option to expose a directory. [ Tests ] Manual reproducer (documented on the bug) confirms the defect and its resolution using the packaged daemon. The bug poster has also tested the underlying patch in various scenarios. [ Risks ] Risk of regressions. The code change is very small and has additionally been scrutinised by the bug reporter. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] The existing code to guard against directory traversal escape is patched to perform its job correctly by advancing past the directory separator before testing for the forbidden path segment. In trixie this is a native package so the patch is applied directly rather than via quilt as it is in sid. [ Other info ] The security team has reviewed the bug and the debdiff and advised to propose this fix via a regular stable update for the forthcoming trixie point release.
diff -Nru shellinabox-2.21/debian/changelog shellinabox-2.21+deb13u1/debian/changelog --- shellinabox-2.21/debian/changelog 2018-09-09 20:10:40.000000000 +0100 +++ shellinabox-2.21+deb13u1/debian/changelog 2026-11-06 23:30:29.000000000 +0000 @@ -1,3 +1,10 @@ +shellinabox (2.21+deb13u1) trixie; urgency=high + + * Fix ineffective --static-file path traversal guard (Closes: #1153131) + Thanks: Alexandru-Ionut Jipa + + -- Andrew Bower <[email protected]> Fri, 06 Nov 2026 23:30:29 +0000 + shellinabox (2.21) unstable; urgency=medium * Patched DoS vulnerability reported by Imre Rad. diff -Nru shellinabox-2.21/shellinabox/externalfile.c shellinabox-2.21+deb13u1/shellinabox/externalfile.c --- shellinabox-2.21/shellinabox/externalfile.c 2015-07-24 03:12:50.000000000 +0100 +++ shellinabox-2.21+deb13u1/shellinabox/externalfile.c 2026-11-06 23:30:05.000000000 +0000 @@ -100,8 +100,8 @@ httpSendReply(http, 404, "File not found", NO_MSG); return HTTP_DONE; } - ptr = strchr(ptr + 1, '/'); - } while (ptr); + ptr = strchrnul(ptr, '/'); + } while (*ptr++); // Point past the dir sep if found } // Open file for reading
signature.asc
Description: PGP signature
