USN-8979-1: deluge vulnerabilities
It was discovered that the web UI in Deluge did not protect against cross- site request forgery. A remote attacker could possibly use this issue to trick a user into installing a malicious plugin, resulting in the execution of arbitrary code. (CVE-2017-7178)
It was discovered that the web UI in Deluge incorrectly handled certain requests. A remote attacker could possibly use this issue to read arbitrary files. (CVE-2017-9031)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/delugeto a version that resolves this vulnerability.Fixed in 1.3.12-1ubuntu1+esm1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Who is exposed to these issues?
Systems running Deluge with its web UI in use are exposed to the affected attack surface. The described attacks are remote and target the web UI.
What does an attacker need to exploit the code-execution issue?
For CVE-2017-7178, an attacker must trick a user into installing a malicious plugin through a cross-site request forgery attack. Successful exploitation can result in arbitrary code execution.
What is the impact of the request-handling issue?
CVE-2017-9031 may allow a remote attacker to read arbitrary files through the Deluge web UI.