Upgrade to QBitorrent 5.0.1 for security patch
Currently there is a know vulnerability that allows for a man in the middle attack that allows for remote code execution.
https://sharpsec.run/rce-vulnerability-in-qbittorrent/
Currently there is a know vulnerability that allows for a man in the middle attack that allows for remote code execution.
https://sharpsec.run/rce-vulnerability-in-qbittorrent/
Comments11
An Anonymous User
Nov 20, 2024
5.0.2 is out, might be worth to rolling it to beta before getting v5.x on stable :)
paradox
Nov 21, 2024
This request has been marked as completed. Do we need to create a new post to request for 5.0.2 ?
berduf
Nov 1, 2024
Also it has a dark theme. No mobile version of the UI though
varg
Nov 1, 2024
We are aware of the vulnerability and our DevOps team is actively investigating.
varg
Nov 2, 2024
qBittorrent v5.0.1 is now available as Beta on the UCP. More information here.
An Anonymous User
Nov 7, 2024
How do I find v5.0.1 qBitorrent in the UCP? I don’t see it at all. My tracker says I need the upgrade.
tuliolazarini
Dec 6, 2024
Hello@varg, I've had a hiccup in my qbittorrent 5.0.1 and the ticket was refused because it’s still in Beta. How about promoting 5.0.1 to stable / GA and start thinking on 5.0.2 for beta? Does that make sense? Thank you!
varg
Dec 6, 2024
Hi,
We always test our applications during the Beta phase to make sure they work in our shared infrastructure. As it has only been a week or two, I’m afraid it is too soon to move it from Beta to an official application. Additionally, as your v5.0.1 instance apparently have issues, it’s an additional argument for keeping it in Beta until we know it is stable enough to be officially supported.
In the meantime, I recommend that you use a previous version of qBittorrent, for example 4.3.9 which is known to be very stable.
tuliolazarini
Dec 6, 2024
The tracker I'm using has banned all qBittorrent versions prior to 5.0.0, due to security concerns, so I'm afraid this is not an option. The issue has solved after I’ve restarted the Nginx (web server), so in the end it was not related to qBittorrent. Anyway, it woud be nice to foresee some timeline to get version 5.0.1 promoted to stable. Thank you.
varg
Dec 10, 2024
I’m afraid we cannot give a timeline for when it will be marked as stable. Rest assured that once we have concluded it to be suitable for our shared infrastructure, it will be marked as stable.
It is unfortunate that your tracker has made such a decision, as it is based on an unfounded fear of an exploit that is more or less theoretical.
tuliolazarini
Dec 10, 2024
Thank you for your attention on this matter. I have followed your advice and nuked my previous qBittorrent installation, started 5.0.1 afresh and haven't had any issues so far. It's working great.
I appreciate the seriousness of promoting version 5.0.1 to production, especially when there’s no critical mass migrated to 5.0.1 yet, nor enough issues reported - a scenario one sysadmin would jump into darkness. Count on any contributions I can provide, as beta tester, to reassure the safety needed to move forward.