openSUSE Leap 15.0 openSUSE-SU-2018:2231-1 Moderate: ZNC Admin Issue

This update for znc fixes the following issues:

- Update to version 1.7.1

* CVE-2018-14055: non-admin user could gain admin privileges and shell

access by injecting values into znc.conf (bnc#1101281)

* CVE-2018-14056: path traversal in HTTP handler via ../ in a web skin

name. (bnc#1101280)

- Update to version 1.7.0

* Make ZNC UI translateable to different languages

* Configs written before ZNC 0.206 can't be read anymore

* Implement IRCv3.2 capabilities away-notify, account-notify,

extended-join

* Implement IRCv3.2 capabilities echo-message, cap-notify on the "client

side"

* Update capability names as they are named in IRCv3.2:

znc.in/server-time-iso?server-time, znc.in/batch?batch. Old names

will continue working for a while, then will be removed in some future

version.

* Make ZNC request server-time from server when available

* Add "AuthOnlyViaModule" global/user setting

*...