openSUSE Security Update : deluge (openSUSE-2017-656)

High Nessus Plugin ID 100658


The remote openSUSE host is missing a security update.


This update for deluge fixes two security issues :

- CVE-2017-9031: A remote attacker may have used a directory traversal vulnerability in the web interface (bsc#1039815)

- CVE-2017-7178: A remote attacher could have exploited a CSRF vulnerability to trick a logged-in user to perform actions in the WebUI (bsc#1039958)

In addition, deluge was updated to 1.3.15 with the following fixes and changes :

- Core: Fix issues with displaying libtorrent-rasterbar single proxy.

- Core: Fix libtorrent-rasterbar 1.2 trackers crashing Deluge UIs.

- Core: Fix an error in torrent priorities causing file priority mismatch in UIs.

- GtkUI: Fix column sort state not saved in Thinclient mode.

- GtkUI: Fix a connection manager error with malformed ip.

- GtkUI: Rename SystemTray/Indicator 'Pause/Resume All' to 'Pause/Resume Session'.

- GtkUI: Workaround libtorrent-rasterbar single proxy by greying out unused proxy types.

- Notification Plugin: Fix webui passing string for int port value.

- AutoAdd Plugin: Add WebUI preferences page detailing lack of configuration via WebUI.

- Label Plugin: Add WebUI preferences page detailing how to configure plugin.

- Core: Fix 'Too many files open' errors.

- Core: Add support for python-GeoIP for use with libtorrent 1.1.

- Core: Fix a single proxy entry being overwritten resulting in no proxy set.

- UI: Add the tracker_status translation to UIs.

- GtkUI: Strip whitespace from infohash before checks.

- GtkUI: Add a missed feature autofill infohash entry from clipboard.

- WebUI: Backport bind interface option for server.

- ConsoleUI: Fix a decode error comparing non-ascii (str) torrent names.

- AutoAdd Plugin: Fixes for splitting magnets from file.

- Remove the duplicate magnet extension when splitting.

- Remove deluge-libtorrent-1.1-geoip.patch: fixed upstream.


Update the affected deluge packages.

See Also

Plugin Details

Severity: High

ID: 100658

File Name: openSUSE-2017-656.nasl

Version: $Revision: 3.2 $

Type: local

Agent: unix

Published: 2017/06/07

Modified: 2018/01/26

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P


Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:deluge, p-cpe:/a:novell:opensuse:deluge-lang, cpe:/o:novell:opensuse:42.2

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 2017/06/06

Reference Information

CVE: CVE-2017-7178, CVE-2017-9031