A flaw was found on Transmission client/server architecture. Clients interact with the daemon using JSON RPC requests to a web server listening on port 9091. The daemon will only accept requests from localhost by default, but it's common to configure NAS devices to accept remote clients. Transmission uses a client/server architecture, the user interface is the client and a daemon runs in the background managing the downloading, seeding, etc. As with all HTTP RPC schemes like this, any website can send requests to the daemon listening on localhost with XMLHttpRequest(), but the theory is they will be ignored because clients must prove they can read and set a specific header, X-Transmission-Session-Id. Unfortunately, this design doesn't work because of an attack called "DNS rebinding". Any website can simply create a dns name that they are authorized to communicate with, and then make it resolve to localhost. References: https://github.com/transmission/transmission/pull/468 https://bugs.chromium.org/p/project-zero/issues/detail?id=1447
Created transmission tracking bugs for this issue: Affects: epel-all [bug 1534063] Affects: fedora-all [bug 1534062]
hi there Please Update Transmission on RHEL7 because there were some connectivity and stability issues that are solved on version 2.94 (May 1, 2018; 10 months ago), but there is no Update available yet! so Please update this to 2.94 on RHEL7 regards
Instead of commenting on unrelated bugs, you should open a separate bug for your request against the right product and component: https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20EPEL&component=transmission&version=epel7 (The above is the guess that you're using packages form EPEL7, as transmission is not part of Red Hat Enterprise Linux.)
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.