| Summary: | deluge new CSRF security issue (CVE-2017-7178) | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | davidwhodgins, lewyssmith, marja11, sysadmin-bugs |
| Version: | 5 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | advisory MGA5-64-OK | ||
| Source RPM: | deluge-1.3.13-1.mga6.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2017-03-14 11:15:18 CET
David Walser
2017-03-14 11:16:14 CET
Whiteboard:
(none) =>
MGA5TOO
Marja Van Waes
2017-03-14 12:31:13 CET
CC:
(none) =>
marja11 Thank you very much David. I have committed deluge-1.3.14 to svn and asked for freeze push for Cauldron. I have updated deluge in Mageia 5 with the security fix included. Package is deluge-1.3.11-1.1.mga5 in core/updates_testing repository. Suggested advisory: ======================== Updated deluge package fixes a CSRF (Cross-site request forgery) vulnerability using upstream patch. Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request.[*] [*] https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) ======================== Updated packages in core/updates_testing: ======================== deluge-1.3.11-1.1.mga5 SRPMS: ======================== deluge-1.3.11-1.1.mga5.src.rpm Assignee:
tarakbumba =>
qa-bugs
Dave Hodgins
2017-03-16 20:31:35 CET
CC:
(none) =>
davidwhodgins
David Walser
2017-03-19 21:53:50 CET
Version:
Cauldron =>
5 Testing M5_64 deluge-1.3.11-1.1.mga5 Deluge was already installed; it updated cleanly. Running it to download our XFCE Live 64-bit from http://srv4.tuxinator.org/mageia/iso/cauldron/torrents/Mageia-6-sta2-LiveDVD-xfce4-x86_64-DVD.torrent Will leave it going a long time to see what happens. It is downloading OK, but not seeding. The various information tabs show nothing! CC:
(none) =>
lewyssmith Testing M5_6' continued from previous comment. Deluge after completing the download in one long session, no getting chunks from here & there. The end result .iso was indentical to the latest testing sta2 one. Then it sat there all day in 'seeding' mode, but with no activity. In the absence of anything obviously wrong, OKing this update. Whiteboard:
advisory =>
advisory MGA5-64-OK You're likely just missing some open ports or routing Lewis. Perhaps uPnP. Validating the update Keywords:
(none) =>
validated_update An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2017-0095.html Status:
NEW =>
RESOLVED This is CVE-2017-7178, according to openSUSE: https://lists.opensuse.org/opensuse-updates/2017-06/msg00014.html Summary:
deluge new CSRF security issue =>
deluge new CSRF security issue (CVE-2017-7178) |