Bug 866842 – <net-p2p/deluge-2.1.1: XSS in webui via crafted torrent file

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2022-08-26 19:22:44 UTC]

CVE-2021-3427:

The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.

Patches: https://dev.deluge-torrent.org/changeset/8ece03677
https://dev.deluge-torrent.org/changeset/a5503c0c606

Both in 2.1.0.

[Comment 1 Sam James 2022-10-11 00:17:07 UTC]

Still pending stabilisation :(

[Comment 2 John Helmert III 2022-10-14 03:15:51 UTC]

GLSA request filed

[Comment 3 John Helmert III 2022-10-14 16:38:50 UTC]

Please cleanup

[Comment 4 Larry the Git Cow 2022-10-15 06:47:49 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5e59c9a6bf0ee6b3aeea0c6b9bc6226896ecc5c5

commit 5e59c9a6bf0ee6b3aeea0c6b9bc6226896ecc5c5
Author:     Joonas Niilola <[e-mail]>
AuthorDate: 2022-10-15 06:44:49 +0000
Commit:     Joonas Niilola <[e-mail]>
CommitDate: 2022-10-15 06:47:46 +0000

    net-p2p/deluge: drop 2.0.5-r2
    
    Bug: https://bugs.gentoo.org/866842
    Signed-off-by: Joonas Niilola <[e-mail]>

 net-p2p/deluge/Manifest                           |   1 -
 net-p2p/deluge/deluge-2.0.5-r2.ebuild             | 144 ----------------------
 net-p2p/deluge/files/deluge-2.0.3-UI-status.patch |  31 -----
 net-p2p/deluge/files/deluge-2.0.3-setup.py.patch  |  11 --
 4 files changed, 187 deletions(-)

[Comment 5 Larry the Git Cow 2022-10-16 14:46:17 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=47660d7639f4e391ab61b168c33a2a1892d5dad8

commit 47660d7639f4e391ab61b168c33a2a1892d5dad8
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-10-16 14:42:29 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-10-16 14:45:24 +0000

    [ GLSA 202210-07 ] Deluge: Cross-Site Scripting
    
    Bug: https://bugs.gentoo.org/866842
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202210-07.xml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

[Comment 6 John Helmert III 2022-10-16 14:58:25 UTC]

GLSA released, all done!