A libtorrent-rasterbar, qbittorrent security update has been released for SUSE Linux Enterprise 15 SP4 and SP5

openSUSE-SU-2023:0391-1: moderate: Security update for libtorrent-rasterbar, qbittorrent

openSUSE Security Update: Security update for libtorrent-rasterbar, qbittorrent
_______________________________

Announcement ID: openSUSE-SU-2023:0391-1
Rating: moderate
References: #1217677
Cross-References: CVE-2023-30801
CVSS scores:
CVE-2023-30801 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:
openSUSE Backports SLE-15-SP4
openSUSE Backports SLE-15-SP5
_______________________________

An update that fixes one vulnerability is now available.

Description:

This update for libtorrent-rasterbar, qbittorrent fixes the following
issues:

Changes in libtorrent-rasterbar:

- Update to version 2.0.9

* fix issue with web seed connections when they close and re-open
* fallocate() not supported is not a fatal error
* fix proxying of IPv6 connections via IPv4 proxy
* treat CGNAT address range as local IPs
* add stricter checking of piece layers when loading torrents
* add stricter checking of v1 and v2 hashes being consistent
* cache failed DNS lookups as well as successful ones
* add an i2p torrent state to control interactions with clear swarms
* fix i2p SAM protocol parsing of quoted messages
* expose i2p peer destination in peer_info
* fix i2p tracker announces
* fix issue with read_piece() stopping torrent on pieces not yet
downloaded
* improve handling of allow_i2p_mixed setting to work for magnet links
* fix web seed request for renamed single-file torrents
* fix issue where web seeds could disappear from resume data
* extend save_resume with additional conditional flags
* fix issue with retrying trackers in tiers > 0
* fix last_upload and last_download resume data fields to use posix time
* improve error messages for no_connect_privileged_ports, by untangle it
from the port filter
* fix I2P issue introduced in 2.0.0
* add async tracker status query, post_trackers()
* add async torrent status query, post_status()
* support loading version 2 of resume data format
* fix issue with odd piece sizes
* add async piece availability query, post_piece_availability()
* add async download queue query, post_download_queue()
* add async file_progress query, post_file_progress()
* add async peer_info query, post_peer_info()

- Update to version 2.0.8

* fix uTP streams timing out instead of closing cleanly
* add write_torrent_file_buf() overload for generating .torrent files
* add create_torrent::generate_buf() function to generate into a buffer
* fix copy_file when the file ends with a sparse region
* uTP performance, fix packet loss when sending is stalled
* fix trackers being stuck after session pause/resume
* fix bug in hash_picker with empty files
* uTP performance, prevent premature timeouts/resends
* add option to not memory map files below a certain size
* settings_pack now returns default values when queried for missing
settings
* fix copy_file fall-back when SEEK_HOL/SEEK_DATA is not supported
* improve error reporting from file copy and move
* tweak pad file placement to match reference implementation
(tail-padding)
* uTP performance, more lenient nagle's algorithm to always allow one
outstanding undersized packet
* uTP performance, piggy-back held back undersized packet with ACKs
* uTP performance, don't send redundant deferred ACKs
* support incoming SOCKS5 packets with hostnames as source address, for
UDP trackers
* ignore duplicate network interface change notifications on linux
* fix total_want/want accounting when forcing a recheck
* fix merging metadata with magnet links added on top of existing
torrents
* add torrent_flag to default all file priorities to dont_download
* fix &so= feature in magnet links
* improve compatibility of SOCKS5 UDP ASSOCIATE
* fix madvise range for flushing cache in mmap_storage
* open files with no_cache set in O_SYNC mode

- Update to version 2.0.7

* fix issue in use of copy_file_range()
* avoid open-file race in the file_view_pool
* fix issue where stop-when-ready would not close files
* fix issue with duplicate hybrid torrent via separate v1 and v2 magnet
links
* added new function to load torrent files, load_torrent_*()
* support sync_file_range()
* fix issue in write_torrent_file() when file size is exactly piece size
* fix file_num_blocks() and file_num_pieces() for empty files
* add new overload to make_magnet_uri()
* add missing protocol version to tracker_reply_alert and
tracker_error_alert
* fix privilege issue with SetFileValidData()
* add asynchronous overload of torrent_handle::add_piece()
* default to a single hashing thread, for full checks
* Fix bug when checking files and the first piece is invalid

Changes in qbittorrent, qbittorrent:

- Update to version 4.6.2

Bug fixes:

* Do not apply share limit if the previous one was applied
* Show Add new torrent dialog on main window screen

Web UI:

* Fix JS memory leak
* Disable stdout buffering for qbt-nox

Wayland:

* Fix parent widget of "Lock qBittorrent" submenu

- Also fixes boo#1217677 (CVE-2023-30801, upstream reference
gh#qbittorrent/qBittorrent#19738)

- Update to version 4.6.1

New features:

* Add option to enable previous Add new torrent dialog behavior

Fixed bugs:

* Prevent crash due to race condition when adding magnet link
* Fix Enter key behavior when add new torrent
* Add missing main window icon
* Update size of selected files when selection is changed
* Correctly handle changing save path of torrent w/o metadata
* Use appropriate icon for "moving" torrents in transfer list

Web UI:

* Drop WebUI default credentials
* Add I2P settings to WebUI
* Fix duplicate scrollbar on Transfer List
* Fix incorrect subcategory sorting
* Correctly set save path in RSS rules
* Allow to request torrents count via WebAPI
* Improve performance of getting torrent numbers via WebAPI
* Improve free disk space checking for WebAPI

Misc:

* Fix invisible tray icon with Qt5 in Linux

- Update to version 4.6.0

New features:

* Add (experimental) I2P support
* Provide UI editor for the default theme
* Various UI theming improvements
* Implement torrent tags editing dialog
* Revamp "Watched folder options" and "Automated RSS downloader" dialog
* Allow to use another icons in dark mode
* Allow to add new torrents to queue top
* Allow to filter torrent list by save path
* Expose 'socket send/receive buffer size' options
* Expose 'max torrent file size' setting
* Expose 'bdecode limits' settings
* Add options to adjust behavior of merging trackers to existing torrent
* Add option to stop seeding when torrent has been inactive
* Allow to use proxy per subsystem
* Expand the scope of "Proxy hostname lookup" option
* Add shortcut for "Ban peer permanently" function
* Add option to auto hide zero status filters
* Allow to disable confirmation of Pause/Resume All
* Add alternative shortcut CTRL+E for CTRL+F
* Show filtered port numbers in logs
* Add button to copy library versions to clipboard

Bug fixes:

* Ensure ongoing storage moving job will be completed when shutting down
* Refactored many areas to call non UI blocking code
* Various improvements to the SQLite backend
* Improve startup window state handling
* Use tray icon from system theme only if option is set
* Inhibit system sleep while torrents are moving
* Use hostname instead of domain name in tracker filter list
* Visually validate input path in torrent creator dialog
* Disable symlink resolving in Torrent creator
* Change default value for `file pool size` and `stop tracker timeout`
settings
* Log when duplicate torrents are being added
* Inhibit suspend instead of screen idle
* Ensure file name is valid when exporting torrents
* Open "Save path" if torrent has no metadata
* Prevent torrent starting unexpectedly edge case with magnet
* Better ergonomics of the "Add new torrent" dialog

WebUI:

* Add log viewer
* WebAPI: Allow to specify session cookie name
* Improve sync API performance
* Add filelog settings
* Add multi-file renaming
* Add "Add to top of queue" option
* Implement subcategories
* Set "SameSite=None" if CSRF Protection is disabled
* Show only hosts in tracker filter list
* Set Connection status and Speed limits tooltips
* set Cross Origin Opener Policy to `same-origin`
* Fix response for HTTP HEAD method
* Preserve the network interfaces when connection is down
* Add "Add Tags" field for RSS rules
* Fix missing error icon

RSS:

* Add "Rename rule" button to RSS Downloader
* Allow to edit RSS feed URL
* Allow to assign priority to RSS download rule

Search:

* Use python isolate mode
* Bump python version minimum requirement to 3.7.0

Other:

* Numerous code improvements and refactorings

- Update to version 4.5.5

Bug fixes:

* Fix transfer list tab hotkey
* Don't forget to enable the Apply button in the Options dialog
* Immediately update torrent status on moving files
* Improve performance when scrolling the file list of large torrents
* Don't operate on random torrents when multiple are selected and a
sort/filter is applied

RSS:

* Fix overwriting feeds.json with an incomplete load of it

- Update to version 4.5.4

Bug fixes:

* Allow to disable confirmation of Pause/Resume All
* Sync flag icons with upstream

Web UI:

* Fix category save path

- Update to version 4.5.3

Bug fixes:

* Correctly check if database needs to be updated
* Prevent incorrect log message about torrent content deletion
* Improve finished torrent handling
* Correctly initialize group box children as disabled in Preferences
* Don't miss saving "download path" in SQLite storage
* Improve logging of running external program

Web UI:

* Disable UPnP for web UI by default
* Use workaround for IOS file picker
* Work around Chrome download limit
* Improve 'exporting torrent' behavior

- Update to version 4.5.2

Bug fixes:

* Don't unexpectedly activate queued torrents when prefetching metadata
for added magnets
* Update the cached torrent state once recheck is started
* Be more likely to allow the system to use power saving modes

Web UI:

* Migrate away from unsafe function
* Blacklist bad ciphers for TLS in the server
* Allow only TLS 1.2+ in the server
* Allow to set read-only directory as torrent location
* Reject requests that contain backslash in path

RSS:

* Prevent RSS folder from being moved into itself

- Update to version 4.5.1

New features:

* Re-allow to use icons from system theme

Bug fixes:

* Fix Speed limit icon size
* Revise and fix some text colors
* Correctly load folder based UI theme
* Fix crash due to invalid encoding of tracker URLs
* Don't drop !qB extension when renaming incomplete file
* Correctly count the number of torrents in subcategories
* Use "additional trackers" when metadata retrieving
* Apply correct tab order to Category options dialog
* Add all torrents passed via the command line
* Fix startup performance on Qt5
* Automatic move will now overwrite existing files
* Some fixes for loading Chinese locales
* New Pause icon color for toolbar/menu
* Adjust env variable for PDB discovery

Web UI:

* Fix missing "queued" icon
* Return paths using platform-independent separator format
* Change order of accepted types of file input
* Add missing icons
* Add "Resume data storage type" option
* Make rename file dialog resizable
* Prevent incorrect line breaking
* Improve hotkeys
* Remove suggestions while searching for torrents
* Expose "IS PRIVATE" flag
* Return name/hash/infohash_v1/infohash_v2 torrent properties

Other:

* Fix tray icon issues

- Update to version 4.5.0

New features:

* Add `Auto resize columns` functionality
* Allow to use Category paths in `Manual` mode
* Allow to disable Automatic mode when default "temp" path changed
* Add tuning options related to performance warnings
* Add right click menu for status filters
* Allow setting the number of maximum active checking torrents
* Add option to toggle filters sidebar
* Allow to set `working set limit` on non-Windows OS
* Add `Export .torrent` action
* Add keyboard navigation keys
* Allow to use POSIX-compliant disk IO type
* Add `Filter files` field in new torrent dialog
* Implement new icon/color theme
* Add file name filter/blacklist
* Add support for custom SMTP ports
* Split the OS cache settings into Disk IO read/write modes
* When duplicate torrent is added set metadata to existing one
* Greatly improve startup time with many torrents
* Add keyboard shortcut to Download URL dialog
* Add ability to run external program on torrent added
* Add infohash and download path columns
* Allow to set torrent stop condition
* Add a `Moving` status filter
* Change color palettes for both dark, light themes
* Add a `Use proxy for hostname lookup` option
* Introduce a `change listen port` cmd option
* Implement `Peer ID Client` column for `Peers` tab
* Add port forwarding option for embedded tracker

Bug fixes:

* Store hybrid torrents using `torrent ID` as basename
* Enable Combobox editor for the `Mixed` file download priority
* Allow shortcut folders for the Open and Save directory dialogs
* Rename content tab `Size` column to `Total Size`
* Fix scrolling to the lowermost visible torrent
* Allow changing file priorities for finished torrents
* Focus save path when Manual mode is selected initially
* Disable force reannounce when it is not possible
* Add horizontal scrolling for tracker list and torrent content
* Enlarge "speed limits" icons
* Change Downloaded to Times Downloaded in trackers tab
* Remove artificial max limits from `Torrent Queueing` related
options
* Preserve `skip hash check` when there is no metadata
* Fix DHT/PeX/LSD status when it is globally disabled
* Fix rate calculation when interval is too low
* Add tooltip message when system tray icon isn't available
* Improve sender field in mail notifications
* Fix "Add torrent dialog" spill-over on smaller screens
* Fix peer count issue when tracker responds with zero figure
* Don't merge trackers by default
* Don't inhibit system sleep/auto shutdown for torrents stuck at
downloading metadata
* Allow to pause a checking torrent from context menu
* Allow to use subnet notation in reverse proxy list
* Fine tune translations loading for Chinese locales
* Fix torrent content checkboxes not updated properly
* Correctly load state of `Use another path for incomplete torrents` in
Watched folders
* Add confirmation to resume/pause all
* Fix wrong count of errored trackers

WebUI:

* Allow blank lines in multipart form-data input
* Make various dialogs resizable
* Fix wrong v2 hash string displayed
* WebAPI: return correct status
* Fix empty selection in language combobox
* Store WebUI port setting in human readable number
* Add support for exporting .torrent
* WebAPI: Add endpoint to set speed limit mode
* Improve progress bar rendering
* Add transfer list refresh interval settings
* Use natural sort
* Apply i18n translation only to built-in WebUI
* Alert when HTTPS settings are incomplete
* Handle drag and drop events
* Fix wrong behavior for shutdown action
* Don't disable combobox for file priority

RSS:

* Increase limit of maximum number of articles per feed

Other:

* Mark as single window app in .desktop file
* Add Dockerfile
* Remove option of using icons from system theme

- Update to version 4.4.5

Bug fixes:

* Fix missing trackers when adding magnet link. Affects libtorrent 2.0.x
builds.

- Update to version 4.4.4.

* Improve D-Bus notifications handling

Bug fixes:

* Correctly handle data decompression with Qt 6.3
* Fix wrong file names displayed in tooltip
* Fix incorrect "max outgoing port" setting
* Make working set limit available only on libtorrent 2.0.x builds
* Try to recover missing tags

RSS:

* Clear RSS parsing error after use

Web API:

* Set HTTP method restriction on WebAPI actions

- Update to version 4.4.3.1

Bug fixes:

* Fix broken translations

- Update to version 4.4.3

Bug fixes:

* Correctly handle changing of temp save path
* Fix storage in SQLite
* Correctly apply content layout when "Skip hash check" is enabled
* Don't corrupt IDs of v2 torrents
* Reduce the number of hashing threads by default (improves hashing
speed on HDDs)
* Prevent the "update dialog" from blocking input on other windows
* Add trackers in exported .torrent files
* Fix wrong GUI behavior in "Optional IP address to bind to" setting

Web UI:

* Fix WebUI crash due to missing tags from config
* Show correct location path

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP5:

zypper in -t patch openSUSE-2023-391=1

- openSUSE Backports SLE-15-SP4:

zypper in -t patch openSUSE-2023-391=1

Package List:

- openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64):

libtorrent-rasterbar-debuginfo-2.0.9-bp155.2.3.1
libtorrent-rasterbar-debugsource-2.0.9-bp155.2.3.1
libtorrent-rasterbar-devel-2.0.9-bp155.2.3.1
libtorrent-rasterbar2_0-2.0.9-bp155.2.3.1
libtorrent-rasterbar2_0-debuginfo-2.0.9-bp155.2.3.1
python3-libtorrent-rasterbar-2.0.9-bp155.2.3.1
python3-libtorrent-rasterbar-debuginfo-2.0.9-bp155.2.3.1

- openSUSE Backports SLE-15-SP5 (aarch64 ppc64le s390x x86_64):

qbittorrent-4.6.2-bp155.2.3.1
qbittorrent-debuginfo-4.6.2-bp155.2.3.1
qbittorrent-debugsource-4.6.2-bp155.2.3.1
qbittorrent-nox-4.6.2-bp155.2.3.1
qbittorrent-nox-debuginfo-4.6.2-bp155.2.3.1

- openSUSE Backports SLE-15-SP5 (noarch):

libtorrent-rasterbar-doc-2.0.9-bp155.2.3.1

- openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64):

libtorrent-rasterbar-devel-2.0.9-bp154.3.3.1
libtorrent-rasterbar2_0-2.0.9-bp154.3.3.1
python3-libtorrent-rasterbar-2.0.9-bp154.3.3.1
qbittorrent-4.6.2-bp154.3.3.1
qbittorrent-debuginfo-4.6.2-bp154.3.3.1
qbittorrent-debugsource-4.6.2-bp154.3.3.1
qbittorrent-nox-4.6.2-bp154.3.3.1
qbittorrent-nox-debuginfo-4.6.2-bp154.3.3.1

- openSUSE Backports SLE-15-SP4 (noarch):

libtorrent-rasterbar-doc-2.0.9-bp154.3.3.1

References:

https://www.suse.com/security/cve/CVE-2023-30801.html
https://bugzilla.suse.com/1217677