CVE-2023-30801

All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.

All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.

All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.

All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.

All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.

All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.

All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.

This update for libtorrent-rasterbar, qbittorrent fixes the following issues:

Changes in libtorrent-rasterbar:

• Update to version 2.0.9

  • fix issue with web seed connections when they close and re-open
  • fallocate() not supported is not a fatal error
  • fix proxying of IPv6 connections via IPv4 proxy
  • treat CGNAT address range as local IPs
  • add stricter checking of piece layers when loading torrents
  • add stricter checking of v1 and v2 hashes being consistent
  • cache failed DNS lookups as well as successful ones
  • add an i2p torrent state to control interactions with clear swarms
  • fix i2p SAM protocol parsing of quoted messages
  • expose i2p peer destination in peer_info
  • fix i2p tracker announces
  • fix issue with read_piece() stopping torrent on pieces not yet downloaded
  • improve handling of allow_i2p_mixed setting to work for magnet links
  • fix web seed request for renamed single-file torrents
  • fix issue where web seeds could disappear from resume data
  • extend save_resume with additional conditional flags
  • fix issue with retrying trackers in tiers > 0
  • fix last_upload and last_download resume data fields to use posix time
  • improve error messages for no_connect_privileged_ports, by untangle it from the port filter
  • fix I2P issue introduced in 2.0.0
  • add async tracker status query, post_trackers()
  • add async torrent status query, post_status()
  • support loading version 2 of resume data format
  • fix issue with odd piece sizes
  • add async piece availability query, post_piece_availability()
  • add async download queue query, post_download_queue()
  • add async file_progress query, post_file_progress()
  • add async peer_info query, post_peer_info()

• Update to version 2.0.8

  • fix uTP streams timing out instead of closing cleanly
  • add write_torrent_file_buf() overload for generating .torrent files
  • add create_torrent::generate_buf() function to generate into a buffer
  • fix copy_file when the file ends with a sparse region
  • uTP performance, fix packet loss when sending is stalled
  • fix trackers being stuck after session pause/resume
  • fix bug in hash_picker with empty files
  • uTP performance, prevent premature timeouts/resends
  • add option to not memory map files below a certain size
  • settings_pack now returns default values when queried for missing settings
  • fix copy_file fall-back when SEEK_HOL/SEEK_DATA is not supported
  • improve error reporting from file copy and move
  • tweak pad file placement to match reference implementation (tail-padding)
  • uTP performance, more lenient nagle's algorithm to always allow one outstanding undersized packet
  • uTP performance, piggy-back held back undersized packet with ACKs
  • uTP performance, don't send redundant deferred ACKs
  • support incoming SOCKS5 packets with hostnames as source address, for UDP trackers
  • ignore duplicate network interface change notifications on linux
  • fix total_want/want accounting when forcing a recheck
  • fix merging metadata with magnet links added on top of existing torrents
  • add torrent_flag to default all file priorities to dont_download
  • fix &so= feature in magnet links
  • improve compatibility of SOCKS5 UDP ASSOCIATE
  • fix madvise range for flushing cache in mmap_storage
  • open files with no_cache set in O_SYNC mode

• Update to version 2.0.7

  • fix issue in use of copy_file_range()
  • avoid open-file race in the file_view_pool
  • fix issue where stop-when-ready would not close files
  • fix issue with duplicate hybrid torrent via separate v1 and v2 magnet links
  • added new function to load torrent files, load_torrent_*()
  • support sync_file_range()
  • fix issue in write_torrent_file() when file size is exactly piece size
  • fix file_num_blocks() and file_num_pieces() for empty files
  • add new overload to make_magnet_uri()
  • add missing protocol…

These are all security issues fixed in the qbittorrent-4.6.2-2.1 package on the GA media of openSUSE Tumbleweed.