Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:transmission
User: [email protected]
Usertags: pu
Fixes a minor security issue, debdiff below. All tests were fine.
Cheers,
Moritz
diff -Nru transmission-4.1.0~beta2+dfsg/debian/changelog
transmission-4.1.0~beta2+dfsg/debian/changelog
--- transmission-4.1.0~beta2+dfsg/debian/changelog 2025-08-23
18:17:20.000000000 +0200
+++ transmission-4.1.0~beta2+dfsg/debian/changelog 2026-09-01
00:05:34.000000000 +0200
@@ -1,3 +1,9 @@
+transmission (4.1.0~beta2+dfsg-3+deb13u2) trixie; urgency=medium
+
+ * CVE-2026-38978
+
+ -- Moritz Mühlenhoff <[email protected]> Tue, 01 Sep 2026 00:05:34 +0200
+
transmission (4.1.0~beta2+dfsg-3+deb13u1) trixie; urgency=medium
* fix GTK app crash when LANG=fr (Closes: #1108194, #1110257)
diff -Nru transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch
transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch
--- transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch
1970-01-01 01:00:00.000000000 +0100
+++ transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch
2026-09-01 00:05:34.000000000 +0200
@@ -0,0 +1,33 @@
+From e51d77e202206ee1389cbd6d9ab154421942b530 Mon Sep 17 00:00:00 2001
+From: Charles Kerr <[email protected]>
+Date: Tue, 31 Mar 2026 09:13:32 -0500
+Subject: [PATCH] fix: add clickjack safeguards when serving http responses
+ (#8747) (#8749)
+
+--- transmission-4.1.0~beta2+dfsg.orig/libtransmission/rpc-server.cc
++++ transmission-4.1.0~beta2+dfsg/libtransmission/rpc-server.cc
+@@ -175,7 +175,15 @@ namespace
+ {
+ int constexpr DeflateLevel = 6; // medium / default
+
+-// ---
++// Prevent clickjacking on the browser-facing WebUI and RPC responses.
++// https://github.com/transmission/transmission/issues/8726
++//
https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html.
++void add_clickjacking_prevention_headers(struct evkeyvalq* headers)
++{
++ // Send X-Frame-Options for older browsers + CSP frame-ancestors for
newer ones
++ evhttp_add_header(headers, "X-Frame-Options", "SAMEORIGIN");
++ evhttp_add_header(headers, "Content-Security-Policy", "frame-ancestors
'self'");
++}
+
+ void send_simple_response(struct evhttp_request* req, int code, char const*
text = nullptr)
+ {
+@@ -499,6 +507,7 @@ void handle_request(struct evhttp_reques
+
+ auto* const output_headers = evhttp_request_get_output_headers(req);
+ evhttp_add_header(output_headers, "Server", MY_REALM);
++ add_clickjacking_prevention_headers(output_headers);
+
+ if (server->is_anti_brute_force_enabled() && server->login_attempts_ >=
server->settings().anti_brute_force_limit)
+ {
diff -Nru transmission-4.1.0~beta2+dfsg/debian/patches/series
transmission-4.1.0~beta2+dfsg/debian/patches/series
--- transmission-4.1.0~beta2+dfsg/debian/patches/series 2025-08-20
11:41:32.000000000 +0200
+++ transmission-4.1.0~beta2+dfsg/debian/patches/series 2026-09-01
00:05:34.000000000 +0200
@@ -5,3 +5,4 @@
web-easier-build.patch
0003-disable-git-hook-installation.patch
0004-do-not-mess-revision.patch
+CVE-2026-38978.patch
