CVE-2018-10895: Possible remote code execution via CSRF in qute://settings

[Axel Beckert]

qutebrowser 1.0.0 to 1.4.0 allows websites to change configuration settings via the qute://settings page by using CSRF. E.g. via the editor setting, this can very likely lead to a remote code execution. This has been fixed in 1.4.1 uploaded to Debian Unstablea few hours ago. Patches for earlier releases are available upstream.

Details at upstream and OSS security:

http://www.openwall.com/lists/oss-security/2018/07/11/7
https://github.com/qutebrowser/qutebrowser/issues/4060
Introduced in: https://github.com/qutebrowser/qutebrowser/commit/ffc29ee (v1.0.0)
Fixed in: https://github.com/qutebrowser/qutebrowser/commit/43e58ac865ff862c2008c510fc5f7627e10b4660 (v1.4.1)

Ubuntu is affected in Bionic (1.1.1-1) and Cosmic (1.4.0-1).

[Axel Beckert (xtaran)]

Meh, can't link this bug report to a CVE report as Launchpad claims that "CVE-2018-10895 is not a valid CVE number". But it obviously is.

[Axel Beckert (xtaran)]

Ok, since half an hour, Cosmic is fixed, probably due to the automatic sync from Debian Unstable.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Launchpad Janitor (janitor)]

This bug was fixed in the package qutebrowser - 1.1.1-1ubuntu0.1

---------------
qutebrowser (1.1.1-1ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Remote code execution due to CSRF on the qute://settings
    page (LP: #1781295):
    - fix-CVE-2018-10895.patch
    - CVE-2018-10895
  * Add a build dependency on dh-python, fixing the FTBFS.

 -- Simon Quigley <email address hidden> Wed, 18 Jul 2018 19:24:09 -0500