Andrew Nesbitt

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A flaw exists where a new transfer utilizing STARTTLS to upgrade the connection may incorrectly reuse an existing live connection despite a mismatch in the TLS configuration. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** opam versions prior to 2.5.1 **Description** A directory traversal issue exists where a `.install` field containing a destination filepath can use `../` to reach a parent directory. **Recommendations** Update to version 2.5.1.