Package: qbittorrent Version: 5.1.0-2 Tags: security upstream fixed-upstream X-Debbugs-CC: [email protected]
Dear Maintainer, Upstream has fixed a security issue in qBittorrent's dynamic DNS functionality that is still present in Debian trixie's 5.1.0-2 package. The public IP address is obtained from http://checkip.dyndns.org over unencrypted HTTP. When dynamic DNS is enabled, an attacker able to modify this response can supply an attacker-controlled IP address. qBittorrent then uses the user's stored credentials to submit that address to the configured DDNS provider, redirecting the hostname to the attacker's infrastructure. Returning a stale address can also suppress legitimate updates. The HTTP request is present in src/base/net/dnsupdater.cpp in Debian's 5.1.0 source archive, and the patches shipped in 5.1.0-2 do not change it. The same issue is present in bookworm's 4.5.2-3+deb12u1 package. Upstream PR #24805 switches IP discovery to HTTPS and also blocks redirects from HTTPS to insecure protocols by default in the shared download manager. The fix is included in upstream 5.3.0. References: Upstream report and fix, PR #24805 Debian 5.1.0 original source Debian 5.1.0-2 packaging and patches Could you assess this issue for security tracking and backporting to the affected supported Debian releases? This report is based on the upstream disclosure and source inspection; I have not reproduced an attack. Kind regards, Jonatan Nyberg
