Versie 5.1.1 van SABnzbd is uitgekomen. Met SABnzbd kunnen bestanden van usenet worden gedownload. Dit opensourceprogramma is beschikbaar voor Windows, Linux en macOS, en biedt de mogelijkheid om nzb-bestanden te laden, waarna de juiste bestanden van usenet worden geplukt. Met de ingebouwde webinterface is het mogelijk om het programma via een webbrowser te bedienen. In deze uitgave is een beveiligingsprobleem in de webinterface verholpen, wat belangrijk is indien deze van vanaf het internet bereikbaar is.
Critical authentication vulnerability resolved in 5.1.1 (GHSA-xrfq-jhgh-wqch)You are only affected if an untrusted party can reach the web interface. By default, SABnzbd is only accessible from your own device and External internet access is set to No access. If either of those is still at its default, or if you use a proxy service for authentication, you are not affected.
If the SABnzbd login page is reachable from outside your network, an attacker could obtain a valid session in version 5.1.0 and earlier, even when SABnzbd is protected with a username and password. This means that all information in SABnzbd would be exposed. If you rely on the SABnzbd username and password to keep out other users on your network or the internet, it is recommended that you change the following sensitive information after applying the update:
If you cannot update right away, the only mitigations are to ensure the web interface is not reachable by untrusted parties, or to lower External internet access to Full API or below. More information.
Other bug fixes in 5.1.1