CVE-2017-9031

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.

References

Affected packages

Debian:11 / deluge

Package

Name: deluge
Purl: pkg:deb/debian/deluge?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.13+git20161130.48cedf63-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / deluge

Package

Name: deluge
Purl: pkg:deb/debian/deluge?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.13+git20161130.48cedf63-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / deluge

Package

Name: deluge
Purl: pkg:deb/debian/deluge?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.13+git20161130.48cedf63-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:14 / deluge

Package

Name: deluge
Purl: pkg:deb/debian/deluge?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.13+git20161130.48cedf63-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/deluge-torrent/deluge

Affected ranges

Type: GIT
Repo: https://github.com/deluge-torrent/deluge
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

9bec5142c72a386a3cb40d3b3169b1ad68a1d969