Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

1.2.5 upgrade procedure might crash #7791

Closed
ThomasWaldmann opened this issue Aug 30, 2023 · 1 comment
Closed

1.2.5 upgrade procedure might crash #7791

ThomasWaldmann opened this issue Aug 30, 2023 · 1 comment
Assignees
@ThomasWaldmann
Labels
bug
Milestone
1.2.6

Comments

@ThomasWaldmann
Copy link
Member

ThomasWaldmann commented Aug 30, 2023 •
edited

background

borg create adds a TAM (a cryptographic authentication tag) to each archive since borg 1.0.9.

But borg rename (and also borg recreate, which internally also renames) did just keep the previous (now invalid) TAM instead of re-computing a correct one for the target archive.

Affected: archives created by borg <= 1.2.4 rename/recreate. Fixed in: borg 1.2.5

broken 1.2.5 upgrade procedure

borg 1.2.5 upgrade procedure stumbles over these "invalid TAM" archives because it either expects no TAM (very old archives of borg < 1.0.9) or a correct TAM. See discussion there: #7787

In that case the upgrade to 1.2.5 must be aborted and borg < 1.2.5 must be used until a fixed version is released.

fix will come with borg 1.2.6, ASAP.
@ThomasWaldmann ThomasWaldmann changed the title borg rename / borg recreate do not re-compute a correct archive TAM 1.2.5 upgrade procedure might crash Aug 30, 2023
@ThomasWaldmann ThomasWaldmann added this to the 1.2.6 milestone Aug 30, 2023
ThomasWaldmann added a commit to ThomasWaldmann/borg that referenced this issue Aug 30, 2023
@ThomasWaldmann
implement BORG_WORKAROUNDS=ignore_invalid_archive_tam, see borgbackup…
8c084f0 
…#7791
@ThomasWaldmann ThomasWaldmann self-assigned this Aug 30, 2023
ThomasWaldmann added a commit to ThomasWaldmann/borg that referenced this issue Aug 30, 2023
@ThomasWaldmann
implement BORG_WORKAROUNDS=ignore_invalid_archive_tam, see borgbackup…
d05d02f 
…#7791
@ajs124 ajs124 mentioned this issue Aug 31, 2023
Merged
12 tasks
@ThomasWaldmann
Copy link
Member Author

Fixed by #7792.

bob-beck pushed a commit to openbsd/ports that referenced this issue Sep 1, 2023
Update to borgbackup-1.2.6
78abca4 
Basically it is the same as the 1.2.5 release, but fixes a possibly
crashing upgrade (borgbackup/borg#7791).
Upgrade procedure is detailed at
https://github.com/borgbackup/borg/blob/1.2.6/docs/changes.rst#pre-125-archives-spoofing-vulnerability-cve-2023-36811
ThomasWaldmann added a commit to ThomasWaldmann/borg that referenced this issue Sep 8, 2023
@ThomasWaldmann
implement BORG_WORKAROUNDS=ignore_invalid_archive_tam, see borgbackup…
1dfc588 
…#7791
ThomasWaldmann added a commit to ThomasWaldmann/borg that referenced this issue Sep 8, 2023
@ThomasWaldmann
implement BORG_WORKAROUNDS=ignore_invalid_archive_tam, see borgbackup…
53bf04f 
…#7791
ThomasWaldmann added a commit to ThomasWaldmann/borg that referenced this issue Sep 8, 2023
@ThomasWaldmann
implement BORG_WORKAROUNDS=ignore_invalid_archive_tam, see borgbackup…
5b2d471 
…#7791
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ThomasWaldmann ThomasWaldmann

Labels
bug
Projects
None yet
Milestone
1.2.6
Development

No branches or pull requests
1 participant
@ThomasWaldmann