Your message dated Tue, 13 Oct 2026 10:05:47 -0000
with message-id <[email protected]>
and subject line 1144839
has caused the Debian Bug report #1144839,
regarding sabnzbdplus: authentication bypass in the web interface
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144839: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144839
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: sabnzbdplus
Severity: grave
Tags: security patch upstream fixed-upstream
X-Debbugs-Cc: [email protected], [email protected]
Hi,
a vulnerability was discovered in sabnzbdplus that allows any client
with access to the password-protected web interface to obtain an
authenticated session without knowing the username or password.
Affected versions are all since 3.0.0 through 5.1.0; for Debian that
translates to every release since bullseye. Fixed in upstream release
5.1.1, meanwhile uploaded to unstable as 5.1.1+dfsg-1.
CVE: [not yet]
Github:
https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-xrfq-jhgh-wqch
Fix:
https://github.com/sabnzbd/sabnzbd/commit/9a12300877a38becda23dada37fd4f9c488801a5
Patches (source debdiff) for the sabnzbdplus package in bookworm and
trixie are attached, and published in the {bookworm,trixie}-security
branches in the package's VCS on salsa. Both have been verified to
build, install, run, and fix the security issue.
sabnzbdplus_3.7.1+dfsg-2+deb12u1.debdiff
Description: Binary data
sabnzbdplus_4.5.0+dfsg-1+deb13u1.debdiff
Description: Binary data
pgpHTq3kRYftC.pgp
Description: OpenPGP digital signature
--- End Message ---
--- Begin Message ---
closing, fixed.
pgp2TST2_gCmw.pgp
Description: OpenPGP digital signature
--- End Message ---
