{"action":"Upgrade archvsync to 20171017 or later.","affected":[{"fixed":"20171017","introduced":"0"}],"component":"archvsync","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["20171017"],"id":"tcs_01M5NCPV4D8MWSWGT913D8AN86","modified_at":"2026-09-01T20:03:51.246342508Z","published_at":"2017-10-17T18:29:00.247Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2017-8805","https://security-tracker.debian.org/tracker/CVE-2017-8805"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2017-8805#Debian:14/archvsync","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2017-8805"}],"summary":"Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal attacks via a crafted upstream mirror."}