Syncthing v1.15.0 [security release] (v1.15.1)

v1.15.0

This release fixes a vulnerability where Syncthing and the relay server can crash due to malformed relay protocol messages (CVE-2021-21404); see Crash due to malformed relay protocol message · Advisory · syncthing/syncthing · GitHub.

This release updates the CLI to use subcommands and adds the subcommands cli (previously standalone stcli utility) and decrypt (for offline verifying and decrypting encrypted folders).

With this release we invite everyone to test the “untrusted (encrypted) devices” feature. You should not use it yet on important production data. Thus UI controls are hidden behind a feature flag. For more information, visit:

Bugfixes

  • #7198: Removing a folder and re-adding it again (untrusted) makes it not sync until restart
  • #7385: infinite filesystem recursion due to missing file id
  • #7419: panic “Snapshot(): database is closed” on start after wiping database
  • #7429: “Ignore Patterns” tab disappears after visiting “Folder Defaults”
  • #7434: Non-DNS-like computer name fails creation of HTTPS certificate
  • #7451: strelaysrv v1.14.0 failing to load
  • #7466: Receive-encrypted fails after a while: file with empty block list
  • #7469: .stignore should be ignored in Receive Encrypted folders
  • #7474: Device tries to push ignored files to a remote device in a 3-device setup
  • #7481: Versioning help strings are not displayed in the GUI
  • #7509: Sharing the first folder to an untrusted device on an established connection sends plain-text

Enhancements

  • #6566: Ship stcli in main package
  • #7457: Remove sub-second precision from the REST API rest/stats/device.
  • #7514: Increase default strelaysrv network buffer size

Other issues

  • #4719: Package stcli as Debian package
  • #7199: Build script -no-upgrade handling is unintuitive
5 Likes

Hi, thanks for the new release :slight_smile:

As noted in the release notes, stcli is now integrated, however, it seem to have a side-effect of slightly changed flags. I’m getting this when my v.1.14 scripts try to start ST after the upgrade:

syncthing: error: unknown flag --config, did you mean "--conf"?

changing the command in my scripts from syncthing --config=<dir> to syncthing --conf=<dir> fixes that.

Docs still mention the --config as the flag to use btw.

Not sure if the change to pre-syncthing cli <stuff> flags was intentional, but it changes the interface, which may break scripts/automation for people…

1 Like

Yeah that’s certainly unintentional.

I’ll fix that in a 1.15.1 before this spreads too wide.

3 Likes

v1.15.1

This is a patch release to correct the inadvertently changed --config flag.

Bugfixes

  • #7532: Removing pending folders is flaky
  • #7549: Flag --config was renamed to --conf in 1.15.0
4 Likes