CVE-2019-13640

Name
CVE-2019-13640
Description
In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed.
NVD Severity
high
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Exploit https://github.com/qbittorrent/qBittorrent/issues/10925
SUSE http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00080.html
SUSE http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00085.html
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH3WYCKODG4OKMC4S6PWHLHAWWU6ORNC/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5T4XAX2VUI4WMAS5AI4OE3OEQSQCDCF5/
DEBIAN https://www.debian.org/security/2020/dsa-4650

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:qbittorrent:qbittorrent:*:*:*:*:*:*:*:* qbittorrent >= None < 4.1.7

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
qbittorrent edge-community 4.1.6-r3 None fixed
qbittorrent 3.22-community 4.1.6-r3 None fixed
qbittorrent 3.21-community 4.1.6-r3 None fixed
qbittorrent 3.20-community 4.1.6-r3 None fixed
qbittorrent 3.19-community 4.1.6-r3 None fixed
qbittorrent 3.18-community 4.1.6-r3 None fixed
qbittorrent 3.17-community 4.1.6-r3 None fixed