Security update for deluge SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:1497-1 Final 1 1 2017-06-06T16:40:38Z current 2017-06-06T16:40:38Z 2017-06-06T16:40:38Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for deluge This update for deluge fixes two security issues: - CVE-2017-9031: A remote attacker may have used a directory traversal vulnerability in the web interface (bsc#1039815) - CVE-2017-7178: A remote attacher could have exploited a CSRF vulnerability to trick a logged-in user to perform actions in the WebUI (bsc#1039958) In addition, deluge was updated to 1.3.15 with the following fixes and changes: - Core: Fix issues with displaying libtorrent-rasterbar single proxy. - Core: Fix libtorrent-rasterbar 1.2 trackers crashing Deluge UIs. - Core: Fix an error in torrent priorities causing file priority mismatch in UIs. - GtkUI: Fix column sort state not saved in Thinclient mode. - GtkUI: Fix a connection manager error with malformed ip. - GtkUI: Rename SystemTray/Indicator 'Pause/Resume All' to 'Pause/Resume Session'. - GtkUI: Workaround libtorrent-rasterbar single proxy by greying out unused proxy types. - Notification Plugin: Fix webui passing string for int port value. - AutoAdd Plugin: Add WebUI preferences page detailing lack of configuration via WebUI. - Label Plugin: Add WebUI preferences page detailing how to configure plugin. - Core: Fix 'Too many files open' errors. - Core: Add support for python-GeoIP for use with libtorrent 1.1. - Core: Fix a single proxy entry being overwritten resulting in no proxy set. - UI: Add the tracker_status translation to UIs. - GtkUI: Strip whitespace from infohash before checks. - GtkUI: Add a missed feature autofill infohash entry from clipboard. - WebUI: Backport bind interface option for server. - ConsoleUI: Fix a decode error comparing non-ascii (str) torrent names. - AutoAdd Plugin: Fixes for splitting magnets from file. - Remove the duplicate magnet extension when splitting. - Remove deluge-libtorrent-1.1-geoip.patch: fixed upstream. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2017-06/msg00002.html E-Mail link for openSUSE-SU-2017:1497-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.2 deluge-1.3.15-3.3.1 deluge-lang-1.3.15-3.3.1 deluge-1.3.15-3.3.1 as a component of openSUSE Leap 42.2 deluge-lang-1.3.15-3.3.1 as a component of openSUSE Leap 42.2 CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its __init__.py file and (2) causing the victim to download, install, and enable this plugin. CVE-2017-7178 openSUSE Leap 42.2:deluge-1.3.15-3.3.1 openSUSE Leap 42.2:deluge-lang-1.3.15-3.3.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-06/msg00002.html https://www.suse.com/security/cve/CVE-2017-7178.html CVE-2017-7178 https://bugzilla.suse.com/1039958 SUSE Bug 1039958 The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file. CVE-2017-9031 openSUSE Leap 42.2:deluge-1.3.15-3.3.1 openSUSE Leap 42.2:deluge-lang-1.3.15-3.3.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-06/msg00002.html https://www.suse.com/security/cve/CVE-2017-9031.html CVE-2017-9031 https://bugzilla.suse.com/1039815 SUSE Bug 1039815 https://bugzilla.suse.com/1039958 SUSE Bug 1039958