openSUSE Security Update: Security update for libtorrent-rasterbar, qbittorrent
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2023:0391-1
Rating:             moderate
References:         #1217677 
Cross-References:   CVE-2023-30801
CVSS scores:
                    CVE-2023-30801 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:
                    openSUSE Backports SLE-15-SP4
                    openSUSE Backports SLE-15-SP5
______________________________________________________________________________

   An update that fixes one vulnerability is now available.

Description:

   This update for libtorrent-rasterbar, qbittorrent fixes the following
   issues:

   Changes in libtorrent-rasterbar:

   - Update to version 2.0.9

     * fix issue with web seed connections when they close and re-open
     * fallocate() not supported is not a fatal error
     * fix proxying of IPv6 connections via IPv4 proxy
     * treat CGNAT address range as local IPs
     * add stricter checking of piece layers when loading torrents
     * add stricter checking of v1 and v2 hashes being consistent
     * cache failed DNS lookups as well as successful ones
     * add an i2p torrent state to control interactions with clear swarms
     * fix i2p SAM protocol parsing of quoted messages
     * expose i2p peer destination in peer_info
     * fix i2p tracker announces
     * fix issue with read_piece() stopping torrent on pieces not yet
       downloaded
     * improve handling of allow_i2p_mixed setting to work for magnet links
     * fix web seed request for renamed single-file torrents
     * fix issue where web seeds could disappear from resume data
     * extend save_resume with additional conditional flags
     * fix issue with retrying trackers in tiers > 0
     * fix last_upload and last_download resume data fields to use posix time
     * improve error messages for no_connect_privileged_ports, by untangle it
       from the port filter
     * fix I2P issue introduced in 2.0.0
     * add async tracker status query, post_trackers()
     * add async torrent status query, post_status()
     * support loading version 2 of resume data format
     * fix issue with odd piece sizes
     * add async piece availability query, post_piece_availability()
     * add async download queue query, post_download_queue()
     * add async file_progress query, post_file_progress()
     * add async peer_info query, post_peer_info()

   - Update to version 2.0.8

     * fix uTP streams timing out instead of closing cleanly
     * add write_torrent_file_buf() overload for generating .torrent files
     * add create_torrent::generate_buf() function to generate into a buffer
     * fix copy_file when the file ends with a sparse region
     * uTP performance, fix packet loss when sending is stalled
     * fix trackers being stuck after session pause/resume
     * fix bug in hash_picker with empty files
     * uTP performance, prevent premature timeouts/resends
     * add option to not memory map files below a certain size
     * settings_pack now returns default values when queried for missing
       settings
     * fix copy_file fall-back when SEEK_HOL/SEEK_DATA is not supported
     * improve error reporting from file copy and move
     * tweak pad file placement to match reference implementation
       (tail-padding)
     * uTP performance, more lenient nagle's algorithm to always allow one
       outstanding undersized packet
     * uTP performance, piggy-back held back undersized packet with ACKs
     * uTP performance, don't send redundant deferred ACKs
     * support incoming SOCKS5 packets with hostnames as source address, for
       UDP trackers
     * ignore duplicate network interface change notifications on linux
     * fix total_want/want accounting when forcing a recheck
     * fix merging metadata with magnet links added on top of existing
       torrents
     * add torrent_flag to default all file priorities to dont_download
     * fix &so= feature in magnet links
     * improve compatibility of SOCKS5 UDP ASSOCIATE
     * fix madvise range for flushing cache in mmap_storage
     * open files with no_cache set in O_SYNC mode

   - Update to version 2.0.7

     * fix issue in use of copy_file_range()
     * avoid open-file race in the file_view_pool
     * fix issue where stop-when-ready would not close files
     * fix issue with duplicate hybrid torrent via separate v1 and v2 magnet
       links
     * added new function to load torrent files, load_torrent_*()
     * support sync_file_range()
     * fix issue in write_torrent_file() when file size is exactly piece size
     * fix file_num_blocks() and file_num_pieces() for empty files
     * add new overload to make_magnet_uri()
     * add missing protocol version to tracker_reply_alert and
       tracker_error_alert
     * fix privilege issue with SetFileValidData()
     * add asynchronous overload of torrent_handle::add_piece()
     * default to a single hashing thread, for full checks
     * Fix bug when checking files and the first piece is invalid

   Changes in qbittorrent, qbittorrent:

   - Update to version 4.6.2

     Bug fixes:

     * Do not apply share limit if the previous one was applied
     * Show Add new torrent dialog on main window screen

     Web UI:

     * Fix JS memory leak
     * Disable stdout buffering for qbt-nox

     Wayland:

     * Fix parent widget of "Lock qBittorrent" submenu

   - Also fixes boo#1217677 (CVE-2023-30801, upstream reference
     gh#qbittorrent/qBittorrent#19738)

   - Update to version 4.6.1

     New features:

     * Add option to enable previous Add new torrent dialog behavior

     Fixed bugs:

     * Prevent crash due to race condition when adding magnet link
     * Fix Enter key behavior when add new torrent
     * Add missing main window icon
     * Update size of selected files when selection is changed
     * Correctly handle changing save path of torrent w/o metadata
     * Use appropriate icon for "moving" torrents in transfer list

     Web UI:

     * Drop WebUI default credentials
     * Add I2P settings to WebUI
     * Fix duplicate scrollbar on Transfer List
     * Fix incorrect subcategory sorting
     * Correctly set save path in RSS rules
     * Allow to request torrents count via WebAPI
     * Improve performance of getting torrent numbers via WebAPI
     * Improve free disk space checking for WebAPI

     Misc:

     * Fix invisible tray icon with Qt5 in Linux


   - Update to version 4.6.0

     New features:

     * Add (experimental) I2P support
     * Provide UI editor for the default theme
     * Various UI theming improvements
     * Implement torrent tags editing dialog
     * Revamp "Watched folder options" and "Automated RSS downloader" dialog
     * Allow to use another icons in dark mode
     * Allow to add new torrents to queue top
     * Allow to filter torrent list by save path
     * Expose 'socket send/receive buffer size' options
     * Expose 'max torrent file size' setting
     * Expose 'bdecode limits' settings
     * Add options to adjust behavior of merging trackers to existing torrent
     * Add option to stop seeding when torrent has been inactive
     * Allow to use proxy per subsystem
     * Expand the scope of "Proxy hostname lookup" option
     * Add shortcut for "Ban peer permanently" function
     * Add option to auto hide zero status filters
     * Allow to disable confirmation of Pause/Resume All
     * Add alternative shortcut CTRL+E for CTRL+F
     * Show filtered port numbers in logs
     * Add button to copy library versions to clipboard

     Bug fixes:

     * Ensure ongoing storage moving job will be completed when shutting down
     * Refactored many areas to call non UI blocking code
     * Various improvements to the SQLite backend
     * Improve startup window state handling
     * Use tray icon from system theme only if option is set
     * Inhibit system sleep while torrents are moving
     * Use hostname instead of domain name in tracker filter list
     * Visually validate input path in torrent creator dialog
     * Disable symlink resolving in Torrent creator
     * Change default value for `file pool size` and `stop tracker timeout`
       settings
     * Log when duplicate torrents are being added
     * Inhibit suspend instead of screen idle
     * Ensure file name is valid when exporting torrents
     * Open "Save path" if torrent has no metadata
     * Prevent torrent starting unexpectedly edge case with magnet
     * Better ergonomics of the "Add new torrent" dialog

     WebUI:

     * Add log viewer
     * WebAPI: Allow to specify session cookie name
     * Improve sync API performance
     * Add filelog settings
     * Add multi-file renaming
     * Add "Add to top of queue" option
     * Implement subcategories
     * Set "SameSite=None" if CSRF Protection is disabled
     * Show only hosts in tracker filter list
     * Set Connection status and Speed limits tooltips
     * set Cross Origin Opener Policy to `same-origin`
     * Fix response for HTTP HEAD method
     * Preserve the network interfaces when connection is down
     * Add "Add Tags" field for RSS rules
     * Fix missing error icon

     RSS:

     * Add "Rename rule" button to RSS Downloader
     * Allow to edit RSS feed URL
     * Allow to assign priority to RSS download rule

     Search:

     * Use python isolate mode
     * Bump python version minimum requirement to 3.7.0

     Other:

     * Numerous code improvements and refactorings

   - Update to version 4.5.5

     Bug fixes:

     * Fix transfer list tab hotkey
     * Don't forget to enable the Apply button in the Options dialog
     * Immediately update torrent status on moving files
     * Improve performance when scrolling the file list of large torrents
     * Don't operate on random torrents when multiple are selected and a
       sort/filter is applied

     RSS:

     * Fix overwriting feeds.json with an incomplete load of it

   - Update to version 4.5.4

     Bug fixes:

     * Allow to disable confirmation of Pause/Resume All
     * Sync flag icons with upstream

     Web UI:

     * Fix category save path

   - Update to version 4.5.3

     Bug fixes:

     * Correctly check if database needs to be updated
     * Prevent incorrect log message about torrent content deletion
     * Improve finished torrent handling
     * Correctly initialize group box children as disabled in Preferences
     * Don't miss saving "download path" in SQLite storage
     * Improve logging of running external program

     Web UI:

     * Disable UPnP for web UI by default
     * Use workaround for IOS file picker
     * Work around Chrome download limit
     * Improve 'exporting torrent' behavior

   - Update to version 4.5.2

     Bug fixes:

     * Don't unexpectedly activate queued torrents when prefetching metadata
       for added magnets
     * Update the cached torrent state once recheck is started
     * Be more likely to allow the system to use power saving modes

     Web UI:

     * Migrate away from unsafe function
     * Blacklist bad ciphers for TLS in the server
     * Allow only TLS 1.2+ in the server
     * Allow to set read-only directory as torrent location
     * Reject requests that contain backslash in path

     RSS:

     * Prevent RSS folder from being moved into itself

   - Update to version 4.5.1

     New features:

     * Re-allow to use icons from system theme

     Bug fixes:

     * Fix Speed limit icon size
     * Revise and fix some text colors
     * Correctly load folder based UI theme
     * Fix crash due to invalid encoding of tracker URLs
     * Don't drop !qB extension when renaming incomplete file
     * Correctly count the number of torrents in subcategories
     * Use "additional trackers" when metadata retrieving
     * Apply correct tab order to Category options dialog
     * Add all torrents passed via the command line
     * Fix startup performance on Qt5
     * Automatic move will now overwrite existing files
     * Some fixes for loading Chinese locales
     * New Pause icon color for toolbar/menu
     * Adjust env variable for PDB discovery

     Web UI:

     * Fix missing "queued" icon
     * Return paths using platform-independent separator format
     * Change order of accepted types of file input
     * Add missing icons
     * Add "Resume data storage type" option
     * Make rename file dialog resizable
     * Prevent incorrect line breaking
     * Improve hotkeys
     * Remove suggestions while searching for torrents
     * Expose "IS PRIVATE" flag
     * Return name/hash/infohash_v1/infohash_v2 torrent properties

     Other:

     * Fix tray icon issues

   - Update to version 4.5.0

     New features:

     * Add `Auto resize columns` functionality
     * Allow to use Category paths in `Manual` mode
     * Allow to disable Automatic mode when default "temp" path changed
     * Add tuning options related to performance warnings
     * Add right click menu for status filters
     * Allow setting the number of maximum active checking torrents
     * Add option to toggle filters sidebar
     * Allow to set `working set limit` on non-Windows OS
     * Add `Export .torrent` action
     * Add keyboard navigation keys
     * Allow to use POSIX-compliant disk IO type
     * Add `Filter files` field in new torrent dialog
     * Implement new icon/color theme
     * Add file name filter/blacklist
     * Add support for custom SMTP ports
     * Split the OS cache settings into Disk IO read/write modes
     * When duplicate torrent is added set metadata to existing one
     * Greatly improve startup time with many torrents
     * Add keyboard shortcut to Download URL dialog
     * Add ability to run external program on torrent added
     * Add infohash and download path columns
     * Allow to set torrent stop condition
     * Add a `Moving` status filter
     * Change color palettes for both dark, light themes
     * Add a `Use proxy for hostname lookup` option
     * Introduce a `change listen port` cmd option
     * Implement `Peer ID Client` column for `Peers` tab
     * Add port forwarding option for embedded tracker

     Bug fixes:

     * Store hybrid torrents using `torrent ID` as basename
     * Enable Combobox editor for the `Mixed` file download priority
     * Allow shortcut folders for the Open and Save directory dialogs
     * Rename content tab `Size` column to `Total Size`
     * Fix scrolling to the lowermost visible torrent
     * Allow changing file priorities for finished torrents
     * Focus save path when Manual mode is selected initially
     * Disable force reannounce when it is not possible
     * Add horizontal scrolling for tracker list and torrent content
     * Enlarge "speed limits" icons
     * Change Downloaded to Times Downloaded in trackers tab
     * Remove artificial max limits from `Torrent Queueing` related
       options
     * Preserve `skip hash check` when there is no metadata
     * Fix DHT/PeX/LSD status when it is globally disabled
     * Fix rate calculation when interval is too low
     * Add tooltip message when system tray icon isn't available
     * Improve sender field in mail notifications
     * Fix "Add torrent dialog" spill-over on smaller screens
     * Fix peer count issue when tracker responds with zero figure
     * Don't merge trackers by default
     * Don't inhibit system sleep/auto shutdown for torrents stuck at
       downloading metadata
     * Allow to pause a checking torrent from context menu
     * Allow to use subnet notation in reverse proxy list
     * Fine tune translations loading for Chinese locales
     * Fix torrent content checkboxes not updated properly
     * Correctly load state of `Use another path for incomplete torrents` in
       Watched folders
     * Add confirmation to resume/pause all
     * Fix wrong count of errored trackers

     WebUI:

     * Allow blank lines in multipart form-data input
     * Make various dialogs resizable
     * Fix wrong v2 hash string displayed
     * WebAPI: return correct status
     * Fix empty selection in language combobox
     * Store WebUI port setting in human readable number
     * Add support for exporting .torrent
     * WebAPI: Add endpoint to set speed limit mode
     * Improve progress bar rendering
     * Add transfer list refresh interval settings
     * Use natural sort
     * Apply i18n translation only to built-in WebUI
     * Alert when HTTPS settings are incomplete
     * Handle drag and drop events
     * Fix wrong behavior for shutdown action
     * Don't disable combobox for file priority

     RSS:

     * Increase limit of maximum number of articles per feed

     Other:

     * Mark as single window app in .desktop file
     * Add Dockerfile
     * Remove option of using icons from system theme

   - Update to version 4.4.5

     Bug fixes:

     * Fix missing trackers when adding magnet link. Affects libtorrent 2.0.x
       builds.

   - Update to version 4.4.4.

     * Improve D-Bus notifications handling

     Bug fixes:

     * Correctly handle data decompression with Qt 6.3
     * Fix wrong file names displayed in tooltip
     * Fix incorrect "max outgoing port" setting
     * Make working set limit available only on libtorrent 2.0.x builds
     * Try to recover missing tags

     RSS:

     * Clear RSS parsing error after use

     Web API:

     * Set HTTP method restriction on WebAPI actions

   - Update to version 4.4.3.1

     Bug fixes:

     * Fix broken translations

   - Update to version 4.4.3

     Bug fixes:

     * Correctly handle changing of temp save path
     * Fix storage in SQLite
     * Correctly apply content layout when "Skip hash check" is enabled
     * Don't corrupt IDs of v2 torrents
     * Reduce the number of hashing threads by default (improves hashing
       speed on HDDs)
     * Prevent the "update dialog" from blocking input on other windows
     * Add trackers in exported .torrent files
     * Fix wrong GUI behavior in "Optional IP address to bind to" setting

     Web UI:

     * Fix WebUI crash due to missing tags from config
     * Show correct location path


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP5:

      zypper in -t patch openSUSE-2023-391=1

   - openSUSE Backports SLE-15-SP4:

      zypper in -t patch openSUSE-2023-391=1



Package List:

   - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64):

      libtorrent-rasterbar-debuginfo-2.0.9-bp155.2.3.1
      libtorrent-rasterbar-debugsource-2.0.9-bp155.2.3.1
      libtorrent-rasterbar-devel-2.0.9-bp155.2.3.1
      libtorrent-rasterbar2_0-2.0.9-bp155.2.3.1
      libtorrent-rasterbar2_0-debuginfo-2.0.9-bp155.2.3.1
      python3-libtorrent-rasterbar-2.0.9-bp155.2.3.1
      python3-libtorrent-rasterbar-debuginfo-2.0.9-bp155.2.3.1

   - openSUSE Backports SLE-15-SP5 (aarch64 ppc64le s390x x86_64):

      qbittorrent-4.6.2-bp155.2.3.1
      qbittorrent-debuginfo-4.6.2-bp155.2.3.1
      qbittorrent-debugsource-4.6.2-bp155.2.3.1
      qbittorrent-nox-4.6.2-bp155.2.3.1
      qbittorrent-nox-debuginfo-4.6.2-bp155.2.3.1

   - openSUSE Backports SLE-15-SP5 (noarch):

      libtorrent-rasterbar-doc-2.0.9-bp155.2.3.1

   - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64):

      libtorrent-rasterbar-devel-2.0.9-bp154.3.3.1
      libtorrent-rasterbar2_0-2.0.9-bp154.3.3.1
      python3-libtorrent-rasterbar-2.0.9-bp154.3.3.1
      qbittorrent-4.6.2-bp154.3.3.1
      qbittorrent-debuginfo-4.6.2-bp154.3.3.1
      qbittorrent-debugsource-4.6.2-bp154.3.3.1
      qbittorrent-nox-4.6.2-bp154.3.3.1
      qbittorrent-nox-debuginfo-4.6.2-bp154.3.3.1

   - openSUSE Backports SLE-15-SP4 (noarch):

      libtorrent-rasterbar-doc-2.0.9-bp154.3.3.1


References:

   https://www.suse.com/security/cve/CVE-2023-30801.html
   https://bugzilla.suse.com/1217677

openSUSE: 2023:0391-1 moderate: libtorrent-rasterbar, qbittorrent

December 7, 2023
An update that fixes one vulnerability is now available

Description

This update for libtorrent-rasterbar, qbittorrent fixes the following issues: Changes in libtorrent-rasterbar: - Update to version 2.0.9 * fix issue with web seed connections when they close and re-open * fallocate() not supported is not a fatal error * fix proxying of IPv6 connections via IPv4 proxy * treat CGNAT address range as local IPs * add stricter checking of piece layers when loading torrents * add stricter checking of v1 and v2 hashes being consistent * cache failed DNS lookups as well as successful ones * add an i2p torrent state to control interactions with clear swarms * fix i2p SAM protocol parsing of quoted messages * expose i2p peer destination in peer_info * fix i2p tracker announces * fix issue with read_piece() stopping torrent on pieces not yet downloaded * improve handling of allow_i2p_mixed setting to work for magnet links * fix web seed request for renamed single-file torr...

Read the Full Advisory

 

Patch

Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-391=1 - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-391=1


Package List

- openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): libtorrent-rasterbar-debuginfo-2.0.9-bp155.2.3.1 libtorrent-rasterbar-debugsource-2.0.9-bp155.2.3.1 libtorrent-rasterbar-devel-2.0.9-bp155.2.3.1 libtorrent-rasterbar2_0-2.0.9-bp155.2.3.1 libtorrent-rasterbar2_0-debuginfo-2.0.9-bp155.2.3.1 python3-libtorrent-rasterbar-2.0.9-bp155.2.3.1 python3-libtorrent-rasterbar-debuginfo-2.0.9-bp155.2.3.1 - openSUSE Backports SLE-15-SP5 (aarch64 ppc64le s390x x86_64): qbittorrent-4.6.2-bp155.2.3.1 qbittorrent-debuginfo-4.6.2-bp155.2.3.1 qbittorrent-debugsource-4.6.2-bp155.2.3.1 qbittorrent-nox-4.6.2-bp155.2.3.1 qbittorrent-nox-debuginfo-4.6.2-bp155.2.3.1 - openSUSE Backports SLE-15-SP5 (noarch): libtorrent-rasterbar-doc-2.0.9-bp155.2.3.1 - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): libtorrent-rasterbar-devel-2.0.9-bp154.3.3.1 libtorrent-rasterbar2_0-2.0.9-bp154.3.3.1 python3-libtorrent-rasterbar-2.0.9-bp154.3.3.1 qbittorrent-4.6.2-bp154.3.3.1 qbittorrent-debuginfo-4.6.2-bp154.3.3.1 qbittorrent-debugsource-4.6.2-bp154.3.3.1 qbittorrent-nox-4.6.2-bp154.3.3.1 qbittorrent-nox-debuginfo-4.6.2-bp154.3.3.1 - openSUSE Backports SLE-15-SP4 (noarch): libtorrent-rasterbar-doc-2.0.9-bp154.3.3.1


References

https://www.suse.com/security/cve/CVE-2023-30801.html https://bugzilla.suse.com/1217677


Severity
Announcement ID: openSUSE-SU-2023:0391-1
Rating: moderate
Affected Products: openSUSE Backports SLE-15-SP4 openSUSE Backports SLE-15-SP5 .

Related News

The End of the Road for Linux 6.11: A Call to Upgrade to Kernel 6.12
3 - 5 min read
The Linux kernel community recently issued an EOL announcement regarding the 6.11 kernel series, urging sysadmins to upgrade quickly to 6.12 . This
A Linux Admin
3 - 6 min read
As 2025 approaches, we Linux admins are facing new and often unseen cloud-native security obstacles. While skilled at mitigating known risks,
Leveraging Insights from the Linux Foundation
3 - 5 min read
The Linux Foundation's recent Census III report provides critical insights for Linux administrators, information security professionals, and anyone
Chrome 131 Released: Emergency Security Update Fixes Over a Dozen Significant Vulns
3 - 6 min read
Google recently unveiled a critical security update to their popular web browser, Google Chrome, addressing over a dozen significant security
From Wayland Fixes to Security Boosts: Examining Qt 6.8.1
3 - 6 min read
The recent Qt 6.8.1 release brings significant updates and improvements, strengthening its reputation as a secure and reliable application
Exploring Arch Linux 2024.12.01: Security Implications & Notable Enhancements for Linux Admins
3 - 6 min read
The Arch Linux 2024.12.01 ISO release marks an impressive milestone, offering cutting-edge updates that enhance functionality, streamline
Deck the Halls with Enhanced Security: Linux Kernel 6.13
3 - 5 min read
As Linux admins and infosec professionals prepare for the holiday season, there's much cause for celebration this year! Linus Torvalds recently made
Lessons from Bootkitty: Securing Linux Systems Against UEFI Intrusions
3 - 5 min read
New Linux security threats mark critical junctures that challenge existing policies and test security protocols to their limit. One such milestone

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved