CVE-2023-36811

Advisory

Vorta 0.9.1beta1 ships with Borg 1.2.6 when using the macOS app to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

I'm proud to release the second beta version of our new 0.9 branch. With [Google Summer of Code](https://github.com/borgbase/vorta/wiki/Google-Summer-of-Code-2023-Ideas) at full steam over the summer, the team got a lot done, with a [few](https://github.com/borgbase/vorta/pull/1742) [major](https://github.com/borgbase/vorta/pull/1809) [features](https://github.com/borgbase/vorta/pull/1749) still pending for the next beta.

Thanks are also due to our mentors, who guided contributors while working on their pull requests. 👏 real-yfprojects Hofer-Julian

Please share your feedback [here](https://github.com/borgbase/vorta/issues/1823), so we can keep improving this branch until the final release.

Breaking changes
This Vorta version ships with Borg 1.2.6 (when using our macOS app), which fixes an issue with data authentication. So you may get an error saying "Data integrity error: Archive authentication did not verify". In that case, at a minimum, if you trust the repository, you need to run the following upgrade steps. Full details are described in [Borg's release notes](https://github.com/borgbackup/borg/blob/1.2.6/docs/changes.rst#pre-125-archives-spoofing-vulnerability-cve-2023-36811):

1. Copy the repository URL. You can do this in Vorta's *Repository* tab using the *Copy to clipboard* button next to the repository selector.
2. Ensure you have the repo passphrase ready. Vorta would keep it in the OS' keychain usually.
3. Run this in the terminal: `BORG_WORKAROUNDS=ignore_invalid_archive_tam borg upgrade --archives-tam $REPO_URL`

Selected major features and improvements
- You can now give names to repos to manage them more easily. By diivi (1665)
- There are now separate unit tests and integration tests with live Borg installs, as well as higher test coverage. By jetchirag and bigtedde
- Password entry is now done with a reusable widget. By jetchirag, 1662
- Vorta now uses Qt6 for the interface. 1685, by i1sm3ky
- sten0 from Debian helped us to clean up our icon licensing situation. 1729

Full list of changes
15fa46ff Improve SSH key process. By bigtedde (1802)
cff00ad8 Add '.log' suffix to log files. By bigtedde (1710)
43140bed Refactor archive context menu. By bigtedde (1793)
3573bdbc Minor: README type. By prady0t (1822)
4350f78d Prevent borg operation while renaming. By bigtedde (1791)
7d2b3634 Changed label and tooltip for startup setting of Vorta (1804)
8c82c406 Changed title of adding `new repo` and `existing repo`. By SAMAD101 (1810)
567a3546 Reduce number of tests. By bigtedde (1780)
e5c9b224 Improve import/export feature test coverage. By bigtedde (1774)
3bfa78bf Fix health indicator always being green in extract view.
2caa0935 Source tab test improvements. By bigtedde (1772)
81920ea3 Repo test improvements. By bigtedde (1771)
e85ec38c Add diff tests. By bigtedde (1770)
ee71bcae DRY tests, increase coverage. By bigtedde (1769)
fb426145 Add test utility functions (1768)
30c57225 Inline archive renaming. By diivi (1734)
92f285f6 Add full font licenses, add Google icons to README. (1740)
b58ffb6a Setting for number format in archive tab. By bigtedde (1719)
b015368f Integration Tests for Borg (1716)
0e37e1cf Correct homebrew path on arm macOS. By sammcj (1760)
25b4cc0b Introduced password input widget (1662)
157ac373 Run actions on multiple archives. By diivi (1723)
ec1dfcd8 Add profile name to error notification. (1728)
d087654e Update GSoC notice in README (1739)
50be34ca Use maintained stale action (1737)
92608f9e Assign names to repos. By diivi (1665)
f76195e4 Disable compact button for older borg versions. By diivi (1727)
c56c6700 Show trigger (user/scheduled) in Archive tab. By diivi (1732)
210a968f Replace CC-BY Vaadin icon (1735)
70ad554e Replace Font Awesome icons with Fork Awesome and others (1729)
2cb9afd4 Add a dev mode that allows for local storing of config files and logs (1682)
5a3a7cf5 Run pre-commit in lint ci and polish ci setup. (1712)
d7634e87 Clear contents of `log_text` after successfull backup (1626)
82270adf Add re-format with ruff to `.git-blame-ignore.revs`.
24e1dd5c Run pre-commit (with newly added ruff) on code base.
f0a5a362 ci: Add ruff including print checks
4d65912d Fix pyobjc imports, bump minimum Python version (1698)
20b7b493 hostname and fqdn template var consistent with Borg (1697)
7535f92a (tag: v0.9.0) PyQt6 Upgrade (1685)
8571ef6c Remove paramiko from dependencies

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36811