Описание
An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..
A vulnerability was found in Qt where, during a TLS connection for servers supporting HTTP2, Qt may send data to a server even if the TLS certificate doesn't match the redirected address. This occurs because Qt fails to validate the certificate against the redirected address, potentially sending data to an incorrect or malicious server.
Отчет
This flaw occurs because Qt does not properly validate the certificate against the redirected address, potentially leading to sensitive data being sent to an unintended or malicious server. Given the potential for significant data exposure, this issue is considered important.
Меры по смягчению последствий
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | qt6-qtbase | Not affected | ||
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | qt5-qtbase | Fixed | RHSA-2024:4647 | 18.07.2024 |
| Red Hat Enterprise Linux 8 | qt5-qtbase | Fixed | RHSA-2024:4617 | 18.07.2024 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | qt5-qtbase | Fixed | RHSA-2024:4646 | 19.07.2024 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | qt5-qtbase | Fixed | RHSA-2024:4621 | 18.07.2024 |
| Red Hat Enterprise Linux 8.4 Telecommunications Update Service | qt5-qtbase | Fixed | RHSA-2024:4621 | 18.07.2024 |
| Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | qt5-qtbase | Fixed | RHSA-2024:4621 | 18.07.2024 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | qt5-qtbase | Fixed | RHSA-2024:4644 | 18.07.2024 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | qt5-qtbase | Fixed | RHSA-2024:4644 | 18.07.2024 |
| Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | qt5-qtbase | Fixed | RHSA-2024:4644 | 18.07.2024 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..
An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..
An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2. ...
EPSS
7.5 High
CVSS3