Re: [BLFS Trac] #23383: sshfs-3.7.6

#23383: sshfs-3.7.6
-------------------------+-------------------------------
 Reporter:  Bruce Dubbs  |       Owner:  SecurityAdvisory
     Type:  enhancement  |      Status:  new
 Priority:  high         |   Milestone:  13.1
Component:  BOOK         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-------------------------------
Changes (by Joe Locash):

 * owner:  Joe Locash => SecurityAdvisory
 * priority:  normal => high
 * status:  assigned => new

Comment:

 {{{
 Release 3.7.6 (2026-05-30)
 --------------------------

 * Added new maintainer: abhinavagarwal07 Abhinav Agarwal
 * Fixed critical vulnerability CVE-2026-47187 - Symlink Escape: Rogue SFTP
 Server to Local File Read/Write), credit to abhinavagarwal07
 * New -o contain_symlinks and -o no_contain_symlinks to control symlink
 containment behavior
 * Fixed high severity vulnerability CVE-2026-48711 - Improper
 Neutralization of Argument Delimiters in a Command ('Argument Injection'),
 credit to abhinavagarwal07
 * Fixed null-deref warning in tokenize_on_space, promote strict-warnings
 to required
 * Added a number of tests in CI, including rename, chmod, fsync, statvfs
 values, error paths, option coverage
 * Fixed malformed SFTP reply handling
 * Hardened Github Actions workflow with SHA pins, permissions, timeouts,
 and dependabot
 }}}
 Fixed at 9dc987c3c2. Leaving open for SA.
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23383#comment:2>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page