Summary
It was discovered that Transmission incorrectly handled certain POST requests to
the RPC server and allowed DNS rebinding attack. An attacker could possibly use this
issue to execute arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | transmission | 2.82-1.1ubuntu3.2 |
| Ubuntu · 16.04 LTS 16.04:LTS | transmission | 2.84-3ubuntu3.1 |
Vulnerabilities 1
-
Unscored —
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access co…
References
-
report
https://ubuntu.com/security/CVE-2018-5702